Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/08/2026, 04:31
Behavioral task
behavioral1
Sample
2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe
- Size 17.2MB
- Sample260825-e5rv2ael6s
- SHA256 4c786d4c1fa46a5c78212da7426124c38c695cbe8f5ef926488243c4a23e7ccb
- MD5 ac7da56805e2fcbc49f97233d51e5ae9
- SHA1 f76b951359f75ce09a53b4d60f0d164c28566891
- SHA512 c6e6d06653cd5f965d3b59b68e40c200f23fb8a48056fdf9bed40e62749f5d06c83635e6d1ba3ea3b943661b8efdeb973547cca896fffae79990c8a8ab77dada
- SSDEEP 196608:ZaHxXME6o966HtIto0Ap6g5qPKrdcljrOOwH+v/6U:ERXMzn6YoIgAjrOB+aU
- TLSH T193073911B1A65BBCC11FD074C58AA9B2A9323C454F209FFB4584FE343E366B45A3972B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\convert.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\OneDriveSetup.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\provlaunch.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\winrshost.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\attrib.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\chkdsk.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\chkdsk.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\ktmutil.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\subst.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\efsui.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\RpcPing.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\scrnsave.scr- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\tracerpt.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\charmap.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\dpnsvr.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\iscsicpl.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\mode.com- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\tttracer.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\wermgr.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\dpapimig.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\instnm.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\dtdump.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\MRINFO.EXE 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\mspaint.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\OposHost.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\powercfg.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\sc.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\pcaui.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\tree.com- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\find.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\RMActivate.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\autofmt.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\proquota.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\icsunattend.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\mmgaserver.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\odbcconf.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\PresentationHost.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\regini.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\hh.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\DWWIN.EXE- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\fsutil.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\PkgMgr.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\RMActivate.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\forfiles.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\mtstocom.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\rasphone.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\calc.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe -
resource yara_rule behavioral1/memory/1072-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/files/0x000e0000000234ea-5.dat upx behavioral1/memory/1072-462-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/1072-3216-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Mozilla Firefox\updater.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Windows Mail\wabmig.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Windows Media Player\wmprph.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Mozilla Firefox\firefox.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.19041.746_none_a89196e695076787\InputSwitchToastHandler.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..client-ui-wscollect_31bf3856ad364e35_10.0.19041.746_none_e7acb2599054dc72\r\WSCollect.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-usercpl-usermgrbroker_31bf3856ad364e35_10.0.19041.746_none_f4a55c2c3386ed90\f\UserAccountBroker.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\x86_regsvcs_b03f5f7f11d50a3a_4.0.15805.0_none_8ce1f3b4679d3a76\RegSvcs.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tieringengine_31bf3856ad364e35_10.0.19041.1_none_6568d39003c9a6d5\TieringEngineService.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-twinui_31bf3856ad364e35_10.0.19041.1202_none_e867a49a6e97813d\LaunchWinApp.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.19041.1_none_b5ee49ccbbfbfddb\sftp.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ervicing-management_31bf3856ad364e35_10.0.19041.746_none_46f79836a0dc7206\Dism.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_f68db62a3702882b\r\SearchFilterHost.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\ImmersiveControlPanel\SystemSettings.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.19041.964_none_a40a1f93665b43eb\SndVol.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-thumbexthost_31bf3856ad364e35_10.0.19041.1_none_a65e065ddcc839c0\ThumbnailExtractionHost.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\SenseCncProxy.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\splwow64.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.19041.1_none_ac040ccaa73c8c1b\user.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.1288_none_a518f9eb1ab503d0\r\hvax64.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_10.0.19041.1202_none_ddf8c4144200f5b4\f\winresume.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ieinstal_31bf3856ad364e35_11.0.19041.1_none_d27e617a9bd9c1d3\ieinstal.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..biometrics-trustlet_31bf3856ad364e35_10.0.19041.1266_none_ba0845abb58c8bdd\BioIso.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ttings-removedevice_31bf3856ad364e35_10.0.19041.746_none_915a78ef54321214\SystemSettingsRemoveDevice.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.19041.844_none_c171e0be75e709de\dsdbutil.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\write.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SystemApps\Microsoft.Windows.AddSuggestedFoldersToLibraryDialog_cw5n1h2txyewy\AddSuggestedFoldersToLibraryDialog.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.19041.1_none_1a55178fad503598\ttdinject.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\Temp\PendingDeletes\36f22f4236e5d701239700001815341f.nfsclnt.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.264_none_583d67d6d00b6b6a\WerFault.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslconfig_31bf3856ad364e35_10.0.19041.1151_none_15ecde7059d11b7f\wslconfig.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.19041.1266_none_fb98272b39a47240\r\MoUsoCoreWorker.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.1_none_216932a6d29366ce\typeperf.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_220320d2c4216035\TiFileFetcher.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.264_none_0e32f443c4669fed\hvix64.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_10.0.19041.1_none_d4cc2ddce5811964\rdpinit.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-runonce_31bf3856ad364e35_10.0.19041.1202_none_94cfabd8a89f0b96\r\runonce.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\x86_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.19041.746_none_4c95cf26b3aa5907\CredentialUIBroker.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.19041.264_none_13222f28beaa00a7\r\vmwp.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.19041.1266_none_3bcd0306a19592e2\f\Robocopy.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..nt-enrollmenthelper_31bf3856ad364e35_10.0.19041.746_none_18c3ddf7dbfedda0\f\PinEnrollmentBroker.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..sktop.appxmain.root_31bf3856ad364e35_10.0.19041.264_none_a71c9f7fdcd899c5\SearchApp.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cttune_31bf3856ad364e35_10.0.19041.1_none_697599f55de29ec6\cttune.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.19041.1202_none_27f9f931a79d1cbe\f\mavinject.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.264_none_4de8bd849baaa96f\r\WerFaultSecure.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.19041.1_none_330dfb2b06b21af6\doskey.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..services-sessionmsg_31bf3856ad364e35_10.0.19041.746_none_18cbe45e21fb4fcb\sessionmsg.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.19041.1237_none_556ba5d1df8130ac\f\printui.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ecapp.appxmain_31bf3856ad364e35_10.0.19041.746_none_db09942beaf4fdfa\r\Microsoft.ECApp.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-utilman_31bf3856ad364e35_10.0.19041.789_none_e07abbe9902a4f60\r\Utilman.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.19041.1266_none_ccf6cb6d0aa9a822\r\mstsc.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-autochk_31bf3856ad364e35_10.0.19041.1_none_97e4facd611ea96a\autochk.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edp-notify_31bf3856ad364e35_10.0.19041.1202_none_958d6588f50ca146\r\edpnotify.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-csp_31bf3856ad364e35_10.0.19041.844_none_c606f47e6aa94b5b\r\hvsievaluator.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_10.0.19041.264_none_098f3a6c3a48359d\f\printfilterpipelinesvc.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.19041.1288_none_4b1349ab76b8812f\r\spoolsv.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ttings-removedevice_31bf3856ad364e35_10.0.19041.1_none_69523ba694c053ca\SystemSettingsRemoveDevice.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.19041.746_none_dbe4ac1121d6e6d7\CertEnrollCtrl.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1_none_6331d348ae4a8fa9\poqexec.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..pgrade-subscription_31bf3856ad364e35_10.0.19041.1_none_07600fc1c7993163\ClipRenew.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-aarsvc_31bf3856ad364e35_10.0.19041.1266_none_d7b5820f5a89765b\agentactivationruntimestarter.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1202_none_23a707c9a0b5a8e1\LaunchTM.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-refsutil_31bf3856ad364e35_10.0.19041.1202_none_5f774093e49b3593\f\refsutil.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..usnotificationuxexe_31bf3856ad364e35_10.0.19041.1266_none_e8d910c7c702b558\r\MusNotificationUx.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.19041.789_none_3136b8d712da0334\XblGameSaveTask.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.19041.1_none_f30cab80229c6b29\ROUTE.EXE- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nbtstat_31bf3856ad364e35_10.0.19041.1_none_540191f5bdbc78d5\nbtstat.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1072
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 17.8MB
- SHA256 35149042d76eec5fd1364228b21cf82e0012cfbaadfdb9bb19996a75f4ad4cec
- MD5 0bab4bb8fbf28ebb7914bdaac85cb1b8
- SHA1 ba50d584679df8a3fe748717c3973529fa860a44
- SHA512 bcd0c886e056c93669cd3f1c5ac3f14b73c1cec0fb2a6d7353d89f35fae086e7ec9d68b8388a8c5a3fc1f6e0be8672cc89922ad07b0e8e61fcac52857a20d83e
- SSDEEP 196608:ZaHxXME6o966HtIto0Ap6g5qPKrdcljrOOwH+v/6+oz:ERXMzn6YoIgAjrOB+a5z
- TLSH T1A0173A11B1A65BBCC11FC074C58AA9B6A9323C454F209FEB4584FF343E366B45A3972B
- MD5 SHA1 SHA512 SSDEEP TLSH