Analysis
- max time kernel
149s - max time network
134s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/08/2026, 12:30
Behavioral task
behavioral1
Sample
2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe
- Size 8.4MB
- Sample260825-ppwt6ascph
- SHA256 969efc46f06b1ea73841d8dec7991721dcdca7095a08ca9921cccfec0339d8f9
- MD5 5d068591e18b90de504907dff01da092
- SHA1 c8fad9aa6672e0d74817a88fbdd57970f4f420f4
- SHA512 a332ff448f4d20e3ec8b0f5fb5c5206a084ff0a37c34bb7b5ad8689732bf117ce4305612e603c557c6e27bc4efe16cf9497ca6c985b33ed57002fe525fd5ab8b
- SSDEEP 98304:SEgc9IW1dXgfC/MHmgtKUgTH2M2m9UMpu1QfLczqssnKSujo7:1mgTH2qBpu1QfLIqsufoo7
- TLSH T1BC96F719A9D68F9DC05F9030CD0667A965237C854F216FDB59807E29BB39FB06E3820F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\chcp.com 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\dxdiag.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\PkgMgr.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\recover.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\typeperf.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\cacls.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\fltMC.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\ndadmin.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\net.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\prevhost.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\diskperf.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\eudcedit.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\logagent.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\RMActivate.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\sdiagnhost.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\winrm.cmd 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\calc.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\svchost.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\driverquery.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\format.com- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\ktmutil.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\LaunchTM.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\mountvol.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\OposHost.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\regini.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\Robocopy.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\dpapimig.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\sdchange.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\setupugc.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\systeminfo.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\unlodctr.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\expand.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\msra.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\regedt32.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\TRACERT.EXE 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\userinit.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\convert.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\ReAgentc.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\regini.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\ROUTE.EXE- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\srdelayed.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\NETSTAT.EXE- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\setx.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\cmd.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\makecab.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\msiexec.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\rekeywiz.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\shutdown.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\icacls.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe -
resource yara_rule behavioral1/memory/4396-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x0014000000024469-5.dat upx behavioral1/memory/4396-732-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/4396-3212-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Windows Mail\wab.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\7-Zip\7z.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\show_third_party_software_licenses.bat 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Mozilla Firefox\firefox.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Windows Media Player\wmpshare.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Windows Mail\wabmig.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\show_third_party_software_licenses.bat 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.19041.746_none_7c508e4438cec899\changepk.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1_none_6f2c92b5bf3d99bc\Taskmgr.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..anagement-dmcfghost_31bf3856ad364e35_10.0.19041.1_none_da2034c2127c2568\dmcfghost.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recover_31bf3856ad364e35_10.0.19041.1_none_3c045b5253f885ed\recover.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.19041.1081_none_e836fc4ed2e2ecc1\r\SpeechModelDownload.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..l-systemuwplauncher_31bf3856ad364e35_10.0.19041.746_none_ed5986fc58f1b817\SystemUWPLauncher.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\vbc.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pickerhost_31bf3856ad364e35_10.0.19041.1023_none_228521f0037fd996\f\PickerHost.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.19041.610_none_d94fa044111e8308\StartMenuExperienceHost.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-synchost_31bf3856ad364e35_10.0.19041.1_none_1f721a9c9befed5e\SyncHost.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.153_none_f3a9dc0fe254a157\wmpconfig.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-engine-main_31bf3856ad364e35_10.0.19041.264_none_c1c396da5ea1410f\f\wbengine.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ices-appcompattools_31bf3856ad364e35_10.0.19041.1_none_a9109d150b1bf064\TSMKUDIR.CMD- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\Temp\PendingDeletes\caae464736e5d7017ea100001815341f.InetMgr6.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bioenrollment.appxmain_31bf3856ad364e35_10.0.19041.844_none_de5d9fe254d9f8c4\f\BioEnrollmentHost.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.19041.1081_none_737d8b2eaaa38234\r\DWWIN.EXE- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-browsercore_31bf3856ad364e35_10.0.19041.1151_none_cf9de3ecb3a8f61c\f\BrowserCore.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\f\SenseSampleUploader.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..riseclientsync-host_31bf3856ad364e35_10.0.19041.207_none_ac38fc33d542b487\WorkFolders.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..setup-compatibility_31bf3856ad364e35_10.0.19041.153_none_4e0da8ffdd43ed0d\NetCfgNotifyObjectHost.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securitycenter-core_31bf3856ad364e35_10.0.19041.1081_none_8f1e438c6737a711\f\wscadminui.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-gdi_31bf3856ad364e35_10.0.19041.1165_none_28f87d0444103fde\f\fontdrvhost.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smss-minwin_31bf3856ad364e35_10.0.19041.964_none_5c42846f47acb1a6\smss.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..egistration-cmdline_31bf3856ad364e35_10.0.19041.1_none_f526198caecd7792\dsregcmd.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..eapplifetimemanager_31bf3856ad364e35_10.0.19041.746_none_45062eb997366a7f\RemoteAppLifetimeManager.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-disksnapshot_31bf3856ad364e35_10.0.19041.1081_none_f52da7b1195e2d45\f\DiskSnapshot.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1202_none_8f7e37524c3e1a13\SystemSettings.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcore_31bf3856ad364e35_10.0.19041.1151_none_21b291c4f7bdb6e0\nfsclnt.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unattendedjoin_31bf3856ad364e35_10.0.19041.572_none_90e9bab3cbbfd71a\r\djoin.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bubbles_31bf3856ad364e35_10.0.19041.1_none_246f53bf694f27f8\Bubbles.scr- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.19041.264_none_8adc8bd8b75d383f\f\UNPUXHost.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.19041.789_none_3136b8d712da0334\r\XblGameSaveTask.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\Temp\PendingDeletes\7deea44536e5d7012c9b00001815341f.InetMgr6.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1202_none_497a4c9b969ee5eb\r\wsmprovhost.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ng-server-isolation_31bf3856ad364e35_10.0.19041.746_none_7aa85dbabd7172c7\r\PrintIsolationHost.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_10.0.19041.1288_none_64cb20c6329bf2bd\f\ntprint.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-control_31bf3856ad364e35_10.0.19041.423_none_81cc87a43da05fd1\control.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-logagent_31bf3856ad364e35_10.0.19041.746_none_d38e81565538dedf\f\logagent.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.19041.746_none_b5fe9c5c09b9d7a9\r\rundll32.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tpm-adminsnapin_31bf3856ad364e35_10.0.19041.1_none_2d6e24727e9eaaa1\TpmInit.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netbt_31bf3856ad364e35_10.0.19041.572_none_3e399e76562f6053\netbtugc.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..client-ui-wscollect_31bf3856ad364e35_10.0.19041.746_none_e7acb2599054dc72\r\WSCollect.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.1_none_216932a6d29366ce\logman.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.264_none_4de8bd849baaa96f\f\WerFaultSecure.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.19041.1288_none_5961108733e967c9\f\LsaIso.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.19041.264_none_64b3f487e354744d\usocoreworker.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.19041.1081_none_5f557b607e14f541\ByteCodeGenerator.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-s..chservice-component_31bf3856ad364e35_10.0.19041.1_none_638e20742b3c9c9a\SpeechRuntime.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-autofmt_31bf3856ad364e35_10.0.19041.1266_none_650ebab5a8c02ffc\autofmt.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.19041.1_none_e4c1e71455c2721c\appidtel.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-apprep-chxapp.appxmain_31bf3856ad364e35_10.0.19041.423_none_15f557c171018574\r\CHXSmartScreen.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fax-service_31bf3856ad364e35_10.0.19041.804_none_8b46258bdefa0beb\r\FXSSVC.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..hreshold-adminflows_31bf3856ad364e35_10.0.19041.1023_none_9583d52fd3076014\SystemSettingsAdminFlows.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.1_none_18b14c7d1478d4cc\sethc.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_netfx4-mscorsvw_exe_b03f5f7f11d50a3a_4.0.15805.0_none_7d38f956251354fe\mscorsvw.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.19041.546_none_9e094af3987dca57\svchost.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..rvices-adam-install_31bf3856ad364e35_10.0.19041.1_none_d2c567b17279a950\adamuninstall.exe- 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-24_5d068591e18b90de504907dff01da092_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4396
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 8.9MB
- SHA256 9f031c93f9e8fca3e0f10d5262aa7e73b8e4d810fe44296d5fb395c0d2c98120
- MD5 da16222c1d4b94d4e711de0c47c0f5c2
- SHA1 751fe118b1e1a6ebcc3ded5acc45ba5ef7480004
- SHA512 97f6b14dfa4d323392978b6d2b4a96ff9cd0a3213b97d6869bb67889800a1eac207ec171a922cca2f0ae47c15c7fdc3e9eb30614618d0c7319fdf312c04735cf
- SSDEEP 98304:SEgc9IW1dXgfC/MHmgtKUgTH2M2m9UMpu1QfLczqssnKSujozjoH:1mgTH2qBpu1QfLIqsufooXoH
- TLSH T1B8960719A9D68F9DC05F9030CD4667A965233C854F206FDB59807E29BE39FB06E3820F
- MD5 SHA1 SHA512 SSDEEP TLSH