Analysis
- max time kernel
149s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/08/2026, 11:20
Behavioral task
behavioral1
Sample
2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe
- Size 22.4MB
- Sample260825-nfec3s1dkc
- SHA256 80ca9723511acb4593b630c2d31623bdf577cd15fd6ba3612e5d036049942e82
- MD5 6896fe8ea93c1895c7bf47a6d7482fd8
- SHA1 b37bbb11e0666f707b3f1a279d633a609bfd7d44
- SHA512 c57287928a1d397621d69f14c3526c401a446158ab14f8ac60d2504318c91b723289f8f833945bec7da5b43bd4625e7b420adcf1fee9bf6999c48710f5a82450
- SSDEEP 196608:ZaHxXME6o966HtIto0Ap6g5qPKrdcljrOOwH+vUgTH2qBpu1QfLIqsufQ:ERXMzn6YoIgAjrOB+XTHNBpu1Qfc0Q
- TLSH T1D8373A11B1A69FACC11FD474C94A69B2A9233C454F205FEB4984FE343E366B45E3922F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\sfc.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\takeown.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\DWWIN.EXE- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\Netplwiz.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\notepad.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\takeown.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\taskkill.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\chkdsk.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\chcp.com 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\PING.EXE 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\PkgMgr.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\TapiUnattend.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\chkntfs.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\logman.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\regsvr32.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\subst.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\systray.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\tasklist.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\TpmInit.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\TpmInit.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\Utilman.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\autofstx.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\msra.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\ROUTE.EXE 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\systeminfo.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\Dism.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\driverquery.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\grpconv.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\label.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\sdiagnhost.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\cliconfg.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\dialer.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\fsquirt.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\notepad.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\printui.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\svchost.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\tttracer.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\openfiles.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\rundll32.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\SyncHost.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\wlanext.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\wscadminui.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\comp.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\help.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\mcbuilder.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\scrnsave.scr- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\TapiUnattend.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\esentutl.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\logman.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\userinit.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\cipher.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe -
resource yara_rule behavioral2/memory/4592-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x0007000000016b4d-5.dat upx behavioral2/memory/4592-254-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/4592-2909-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Windows Media Player\wmpshare.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Windows Defender\MpDlpCmd.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_winappsdk-cbs_31bf3856ad364e35_10.0.26100.1591_none_60aad032a4073cbd\r\RestartAgent.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regsql.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\splwow64.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..frameworks-usermode_31bf3856ad364e35_10.0.26100.1591_none_38d18bb2a54a6d36\r\WUDFHost.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapp.appxmain_31bf3856ad364e35_10.0.26100.1591_none_83300daf83f8b2a6\LockApp.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..nt-enrollmenthelper_31bf3856ad364e35_10.0.26100.1591_none_d68a8e522d36701f\PinEnrollmentBroker.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.26100.1591_none_59ddd41753bfcf7d\r\Narrator.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.26100.1591_none_e4284e3cb060c8bf\r\wscript.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.26100.1150_none_3a3e93ee89e96c57\r\UpgradeResultsUI.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_netfx-dfsvc_b03f5f7f11d50a3a_10.0.26100.1_none_6694132cb1b96a0b\dfsvc.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.26100.1_none_b079f7ba2cc824d5\PATHPING.EXE- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..services-sessionmsg_31bf3856ad364e35_10.0.26100.1150_none_d6b9ea087315f389\r\sessionmsg.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-dpiscaling_31bf3856ad364e35_10.0.26100.1_none_819025e8f7dd72e4\DpiScaling.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-proquota_31bf3856ad364e35_10.0.26100.1_none_2f0f4a8a2f528469\proquota.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.26100.1_none_9187ca465243b700\schtasks.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-dtc-runtime_31bf3856ad364e35_10.0.26100.1150_none_b53a535c0fece405\r\msdtc.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.26100.1591_none_ed74a23929c34603\r\explorer.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SystemApps\LKG\MicrosoftWindows.LKG.Search_cw5n1h2txyewy\MiniSearchHost.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapphost_31bf3856ad364e35_10.0.26100.1591_none_97668666133579f2\r\LockAppHost.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.26100.1591_none_70d0fee4fcc0ae07\sdbinst.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-servicing_31bf3856ad364e35_10.0.26100.1150_none_c1fbd1a9557e5b13\bfsvc.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-choice_31bf3856ad364e35_10.0.26100.1_none_c05a936cf44f86b0\choice.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1150_none_fd0acb47aebf06db\r\relog.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-mbr2gpt_31bf3856ad364e35_10.0.26100.1591_none_9271e9806df3ec14\MBR2GPT.EXE- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\chgport.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-inputredirection_31bf3856ad364e35_10.0.26100.1591_none_9fe4b2d813f9a989\r\rdpinput.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-commandprompt_31bf3856ad364e35_10.0.26100.1591_none_26ccc1e3ca6360b3\r\cmd.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-efs-ui_31bf3856ad364e35_10.0.26100.1_none_f3687062f0231686\efsui.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msmq-triggers-service_31bf3856ad364e35_10.0.26100.1591_none_c3e67f006d0c06f6\r\mqtgsvc.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.26100.1150_none_fb078fe8106f7572\cmdl32.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tapisetup_31bf3856ad364e35_10.0.26100.1150_none_05da7b3a4b13ee64\TapiUnattend.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.26100.1150_none_71cd60532ab93f47\TSTheme.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_aspnet_compiler_b03f5f7f11d50a3a_4.0.15912.0_none_75b001d640e3113b\aspnet_compiler.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-packageinspector_31bf3856ad364e35_10.0.26100.1_none_6775b02f27bc2b3e\PackageInspector.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.26100.1591_none_6d1bd4f9d0cbd5f8\r\Robocopy.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-core_31bf3856ad364e35_10.0.26100.1591_none_50ccbceb26d74098\fhmanagew.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-refsutil_31bf3856ad364e35_10.0.26100.1591_none_86770ed0df6bb53c\refsutil.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\msil_wsatconfig_b03f5f7f11d50a3a_10.0.26100.1_none_ad1d52a56b0a48f7\WsatConfig.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.26100.1591_none_70cfc556f1a01eb7\r\CredentialUIBroker.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-cli-main_31bf3856ad364e35_10.0.26100.1_none_48488580f79252e6\wbadmin.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..alenrollmentmanager_31bf3856ad364e35_10.0.26100.1591_none_4177de30403bfb76\CredentialEnrollmentManager.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..me-japanese-setting_31bf3856ad364e35_10.0.26100.1591_none_58449d9961468d2f\IMJPSET.EXE- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-ui_31bf3856ad364e35_10.0.26100.1591_none_e9f27dc23b0bf8db\FileHistory.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..eminputhost-process_31bf3856ad364e35_10.0.26100.1150_none_24aebd36aef95f82\ISM.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..oreuap-iotuap-tools_31bf3856ad364e35_10.0.26100.1150_none_c74b9bded5451f89\r\iotstartup.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-tool-exe_31bf3856ad364e35_10.0.26100.1_none_f70e66181fe2eced\manage-bde.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.26100.1591_none_0f19119bcdcaf335\r\SpeechModelDownload.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..pectedcodepathtasks_31bf3856ad364e35_10.0.26100.1591_none_99fc5c721ed12b35\r\UCConfigTask.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-makecab_31bf3856ad364e35_10.0.26100.1_none_f817d499062c355e\makecab.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.26100.1591_none_51f10c4fde15e277\msinfo32.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SystemApps\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\PinningConfirmationDialog.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.26100.1150_none_00fe88f91f962b70\r\gpscript.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ndkping-setup_31bf3856ad364e35_10.0.26100.1150_none_544768fb4cb870ae\r\NDKPing.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-webauth_31bf3856ad364e35_10.0.26100.1_none_28969e415f79b32c\AuthHost.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.26100.1_none_a518656df7c165fb\SenseImdsCollector.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.26100.1_none_b53c1c347378366d\setup_wm.exe- 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-24_6896fe8ea93c1895c7bf47a6d7482fd8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4592
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 23.4MB
- SHA256 dc903dfb9be8436b490c8259dbf4e5a7ee6d6fd27f3688c73689360816beb7df
- MD5 74966400d672558eb1f77ee047b078ec
- SHA1 b179dc5722452b8a40ebb160cb0d39993c7de5a6
- SHA512 eac2aa02a604da560d192f489eb0788d35858ee1dfef12f91e2b4e04fab00870a2750f5fa927701a0404cd1d6a42cdbec75a692f7aefa7db33a627d623fef7bf
- SSDEEP 196608:ZaHxXME6o966HtIto0Ap6g5qPKrdcljrOOwH+vUgTH2qBpu1QfLIqsuf2l:ERXMzn6YoIgAjrOB+XTHNBpu1Qfc0i
- TLSH T1B4372911B1A69FACC15FD074C94AA9B2A9233C454F205FEB4584FE343E366B45E3922F
- MD5 SHA1 SHA512 SSDEEP TLSH