Analysis
- max time kernel
150s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/08/2026, 04:31
Behavioral task
behavioral1
Sample
2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe
- Size 17.2MB
- Sample260825-e5rv2ael6s
- SHA256 4c786d4c1fa46a5c78212da7426124c38c695cbe8f5ef926488243c4a23e7ccb
- MD5 ac7da56805e2fcbc49f97233d51e5ae9
- SHA1 f76b951359f75ce09a53b4d60f0d164c28566891
- SHA512 c6e6d06653cd5f965d3b59b68e40c200f23fb8a48056fdf9bed40e62749f5d06c83635e6d1ba3ea3b943661b8efdeb973547cca896fffae79990c8a8ab77dada
- SSDEEP 196608:ZaHxXME6o966HtIto0Ap6g5qPKrdcljrOOwH+v/6U:ERXMzn6YoIgAjrOB+aU
- TLSH T193073911B1A65BBCC11FD074C58AA9B2A9323C454F209FFB4584FE343E366B45A3972B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\ctfmon.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\dialer.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\sudo.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\timeout.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\mstsc.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\Netplwiz.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\shutdown.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\unlodctr.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\cmdkey.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\dplaysvr.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\ftp.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\tracerpt.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\unlodctr.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\certreq.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\Taskmgr.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\net.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\printui.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\Taskmgr.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\bthudtask.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\dpnsvr.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\fltMC.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\icsunattend.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\mspaint.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\PkgMgr.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\unregmp2.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\wscadminui.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\mobsync.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\msiexec.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\pcaui.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\regedt32.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\ttdinject.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\tzutil.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\AtBroker.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\diskperf.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\driverquery.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\instnm.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\dialer.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\dvdplay.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\eudcedit.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\newdev.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\DWWIN.EXE- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\net.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\where.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\AppVDllSurrogate.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\System32\DriverStore\FileRepository\kdnic.inf_amd64_a9d04a55194853d2\kdnicctrl.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\sdbinst.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\autofstx.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\explorer.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\mtstocom.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\eventcreate.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\finger.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\fontview.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\perfhost.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\winver.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\wscript.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\xcopy.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\chcp.com- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe -
resource yara_rule behavioral2/memory/4636-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x000c000000019cb8-5.dat upx behavioral2/memory/4636-362-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/4636-2918-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Windows Defender\MpCopyAccelerator.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Windows Media Player\wmplayer.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\7-Zip\Uninstall.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-choice_31bf3856ad364e35_10.0.26100.1_none_c05a936cf44f86b0\choice.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-commandline-dsacls_31bf3856ad364e35_10.0.26100.1_none_460eda816899b508\dsacls.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lua_31bf3856ad364e35_10.0.26100.1150_none_4231ada90cb553fb\consent.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcore_31bf3856ad364e35_10.0.26100.1150_none_48c9cd2bf27dfea7\r\nfsclnt.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sigverif_31bf3856ad364e35_10.0.26100.1_none_b88d2cbd63eb3d30\sigverif.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-icm-dccw_31bf3856ad364e35_10.0.26100.1_none_2236fe932b70aa37\dccw.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.26100.1742_none_200d0ee10b67fc30\nvspinfo.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..services-sessionmsg_31bf3856ad364e35_10.0.26100.1150_none_d6b9ea087315f389\r\sessionmsg.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.26100.1_none_b079f7ba2cc824d5\PATHPING.EXE- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-timeout_31bf3856ad364e35_10.0.26100.1_none_93acbf7363320dcd\timeout.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ommandline-repadmin_31bf3856ad364e35_10.0.26100.1_none_a19933cd034a9aa0\repadmin.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-edge-webview_31bf3856ad364e35_10.0.26100.1_none_8fe1c356f34a19ca\notification_helper.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-atbroker_31bf3856ad364e35_10.0.26100.1591_none_6b60aaf7ce5c0f38\AtBroker.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printdialog.appxmain_31bf3856ad364e35_10.0.26100.1591_none_20d2a02f892fa68f\r\PrintDialog.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_10.0.26100.1591_none_dad8c095acaa16b9\r\services.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.26100.1591_none_161bc21b2130ea78\WerFaultSecure.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.26100.1_none_b0d3de420cfbf405\iissetup.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-packagemanager_31bf3856ad364e35_10.0.26100.1591_none_92ec6994d7abdee6\PkgMgr.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\x86_netfx-vb_compiler_b03f5f7f11d50a3a_10.0.27000.360_none_22e4d76dba1efc07\vbc.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\AccountsControlHost.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.26100.1_none_9609b71ef8d18dee\dfrgui.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..odeupdate-servicing_31bf3856ad364e35_10.0.26100.1_none_a07bad500e90d9fe\ucsvc.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runonce_31bf3856ad364e35_10.0.26100.1591_none_b17acfc36f0ec944\r\runonce.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.26100.1150_none_5404854ee1749b61\r\shrpubw.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_userexperience-lkg_31bf3856ad364e35_10.0.26100.1742_none_3c72368675eae921\LKG.Search\FESearchHost.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\x86_microsoft-windows-photoscreensaver_31bf3856ad364e35_10.0.26100.712_none_b1d1fad188ff9ad7\PhotoScreensaver.scr- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.26100.1591_none_62c72aa79c6b13fd\Robocopy.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-calc_31bf3856ad364e35_10.0.26100.1_none_b10653edb7a9547d\calc.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\hh.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-containerdiagnosticstool_31bf3856ad364e35_10.0.26100.1150_none_234860e0e753c908\r\hcsdiag.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-autofstx_31bf3856ad364e35_10.0.26100.1591_none_4acfacd4985a9f74\autofstx.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nslookup_31bf3856ad364e35_10.0.26100.1150_none_6767c467165c7708\nslookup.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_windows-securityhealth-sso_31bf3856ad364e35_10.0.26100.1591_none_5b0badbc2600416b\SecurityHealthSystray.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\x86_netfx4-aspnet_state_exe_b03f5f7f11d50a3a_4.0.15912.0_none_a98d653d335a00f2\aspnet_state.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicepairingapp_31bf3856ad364e35_10.0.26100.1150_none_0b85b224b1f670b4\DevicePairingWizard.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.26100.1150_none_fb078fe8106f7572\r\cmdl32.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tpm-tool_31bf3856ad364e35_10.0.26100.1591_none_99f9c6049c838786\r\TpmTool.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-repadmin_31bf3856ad364e35_10.0.26100.1150_none_9cab7767030559d4\r\repadmin.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.26100.1591_none_86d079db2c05e448\ResetEngine.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsmanager_31bf3856ad364e35_10.0.26100.1591_none_b7cec9dc382cb5f1\WmsManager.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-regsvr32_31bf3856ad364e35_10.0.26100.1_none_7f9f7003cc70f4b2\regsvr32.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInUtil.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1150_none_fd0acb47aebf06db\relog.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.26100.1591_none_09f5b9f9e6fe0f73\hvsiproxyapp.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.26100.1_none_e1bbfdf0b2054cc5\iscsicli.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\regedit.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.26100.1591_none_f543f8b3b0fee44f\r\IMTCPROP.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ktmutil_31bf3856ad364e35_10.0.26100.1150_none_24714894b112c0f3\ktmutil.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ountcontrolsettings_31bf3856ad364e35_10.0.26100.1591_none_1f650d1288a260be\UserAccountControlSettings.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-voiceaccessstub_31bf3856ad364e35_10.0.26100.1591_none_129ee3df08a8deda\VoiceAccess.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..me-japanese-setting_31bf3856ad364e35_10.0.26100.1591_none_58449d9961468d2f\r\IMJPSET.EXE- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-newdev_31bf3856ad364e35_10.0.26100.1_none_18be9e06ed967433\ndadmin.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-engine-main_31bf3856ad364e35_10.0.26100.1591_none_7fa1f11eafc6c01d\r\wbengine.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\x86_netfx-aspnet_wp_exe_b03f5f7f11d50a3a_10.0.26100.1_none_69287f183fd23745\aspnet_wp.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\Microsoft.Uev.CscUnpinTool.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..mnotificationbroker_31bf3856ad364e35_10.0.26100.1_none_c4a8407c4f3e3810\DmNotificationBroker.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.26100.1591_none_71da000f2a392039\IMCCPHR.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\r\CBS\TextInputHost.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.26100.1591_none_c68b578eea4bd528\r\wermgr.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.26100.1_none_1831c57751bfb3cc\iisreset.exe- 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\IEExec.exe 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-24_ac7da56805e2fcbc49f97233d51e5ae9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4636
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 18.2MB
- SHA256 49ad9507b4c332e6fb94d24977c420e7654dc3f5d8bc6b54bd45817455d00ce6
- MD5 e3971f209fea7d4cb8091902c4fe5121
- SHA1 c17f9ebaf8900c37f7e5a8f32417b4c0a58f9906
- SHA512 ae913216845c50364c48a46d17d95c308a11a1d4eb0e7091c7f8929d53ed85fa4a18f93389f881b56249e28021c9634d5f7dfd2d3c8f575d0cf52dccce215f0d
- SSDEEP 196608:ZaHxXME6o966HtIto0Ap6g5qPKrdcljrOOwH+v/6Kl:ERXMzn6YoIgAjrOB+ae
- TLSH T1F4173A11B1A65BBDC12FC074C58AA9B2B9323C454F205EEB4584FF343E366F45A3972A
- MD5 SHA1 SHA512 SSDEEP TLSH