Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
26/08/2026, 22:59
Behavioral task
behavioral1
Sample
2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
- Size 6.0MB
- Sample260826-2yr9jsxeqf
- SHA256 2b359c87da927b8d828c7aaf22133d7bc342ecb9e46e37733b934c20f63f5a3a
- MD5 669a23c2e08f3cfe4e2181ead63ca523
- SHA1 1633866911017d32c1e34c29527596345cb70af1
- SHA512 38f645b8c984c485c9169561731e71fe85da04bdddb9097d8a69a05cd4e178f83ada54abbc984820f065fb820483e93f3e3678d0c3f542d945d6d589affd87b2
- SSDEEP 49152:Jx/WPv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dS:PIKUgTH2M2m9UMpu1QfLczqssnKSx
- TLSH T1B856C41165DA9FDCC05FA474CE0669A16A237C868F61AFDF0980BE253E756B06F3810F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\certutil.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\regedit.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\tar.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\user.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\dcomcnfg.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\net.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\notepad.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\control.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\net1.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\ROUTE.EXE- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\rrinstaller.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\wermgr.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\wowreg32.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Fondue.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\ipconfig.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\mcbuilder.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\waitfor.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\mspaint.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cmd.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\chkntfs.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cipher.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Netplwiz.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\sdiagnhost.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\sort.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\subst.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\eventcreate.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\findstr.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\WWAHost.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\eventvwr.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\fsquirt.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\netsh.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\nslookup.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\bootcfg.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\msdt.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\hdwwiz.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\icsunattend.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\OneDriveSetup.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\appidtel.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\chkdsk.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\diskpart.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\dpnsvr.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\help.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\prevhost.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\sort.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Utilman.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\fltMC.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\ntprint.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\PickerHost.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\rasphone.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe -
resource yara_rule behavioral1/memory/1012-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x000500000001690d-5.dat upx behavioral1/memory/1012-912-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/1012-3236-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Windows Mail\wab.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{74A5E9DB-42A6-4629-9DA9-DE27556EBF1E}\MicrosoftEdge_X64_139.0.3405.125.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Media Player\wmplayer.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Media Player\wmpshare.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-bash_31bf3856ad364e35_10.0.19041.117_none_1db60e061b48335a\f\bash.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mdmappinstaller_31bf3856ad364e35_10.0.19041.844_none_77a5d9aafae08e77\r\MDMAppInstaller.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.19041.1266_none_21c0be7c0dad3632\r\UNPUXHost.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..ment-windows-minwin_31bf3856ad364e35_10.0.19041.1266_none_c4b179e0b12fe4b9\r\winload.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-omadmclient_31bf3856ad364e35_10.0.19041.1151_none_c86feb6936a97173\r\omadmclient.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fsutil_31bf3856ad364e35_10.0.19041.1_none_825521fc8f4a22ac\fsutil.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.19041.1081_none_e836fc4ed2e2ecc1\f\SpeechModelDownload.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.19041.1266_none_fb98272b39a47240\f\MoUsoCoreWorker.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mapi_31bf3856ad364e35_10.0.19041.423_none_93adcfb5ace23a89\fixmapi.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\PinningConfirmationDialog.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-settingsynchost_31bf3856ad364e35_10.0.19041.1_none_35d43a0ec2872060\SettingSyncHost.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-storage-diagnostics_31bf3856ad364e35_10.0.19041.1_none_2aa26221a7a3d549\stordiag.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-tools_31bf3856ad364e35_10.0.19041.1_none_8dec776522fcecde\wbemtest.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..anagement-dmcfghost_31bf3856ad364e35_10.0.19041.1_none_da2034c2127c2568\dmcfghost.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ice-remoteposworker_31bf3856ad364e35_10.0.19041.1_none_d570c31a162768ba\RemotePosWorker.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-disksnapshot_31bf3856ad364e35_10.0.19041.1_none_3640cf5b039ce2f0\DiskSnapshot.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..nsimulation-service_31bf3856ad364e35_10.0.19041.746_none_b6b8620636970859\PerceptionSimulationService.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-servicing_31bf3856ad364e35_10.0.19041.1237_none_9ad73d125ac89655\r\bfsvc.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dlna-mdeserver_31bf3856ad364e35_10.0.19041.746_none_b4017de081b11e02\f\MDEServer.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edge-microsoftedgecp_31bf3856ad364e35_10.0.19041.1_none_77274ce3b079d8f5\MicrosoftEdgeCP.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.19041.1266_none_3bcd0306a19592e2\Robocopy.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.1266_none_5fd6523a3130632d\r\ResetEngine.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.19041.264_none_8adc8bd8b75d383f\f\UNPUXHost.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wsl_31bf3856ad364e35_10.0.19041.117_none_610933d42d963a44\f\wsl.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..executionprevention_31bf3856ad364e35_10.0.19041.1_none_7fd47726c3f6f6dd\SystemPropertiesDataExecutionPrevention.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.19041.610_none_d94fa044111e8308\f\StartMenuExperienceHost.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.19041.746_none_d19001beed7624dc\r\CertEnrollCtrl.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_ec390bd802a1c630\SearchIndexer.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.19041.906_none_72b8b02e4865ebca\f\schtasks.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_adobe-flash-for-windows_31bf3856ad364e35_10.0.19041.82_none_2358a116979cc599\FlashUtil_ActiveX.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..tx-dxgiadaptercache_31bf3856ad364e35_10.0.19041.928_none_85ac1b118ff2a924\f\dxgiadaptercache.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-commandprompt_31bf3856ad364e35_10.0.19041.746_none_735abbdbad8c902f\cmd.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-xbox-gameoverlay_31bf3856ad364e35_10.0.19041.746_none_2703bed0ba809808\f\GamePanel.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.19041.746_none_b5fe9c5c09b9d7a9\r\rundll32.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-prompt_31bf3856ad364e35_10.0.19041.1_none_a6007aa58351ad08\fveprompt.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-browsercore_31bf3856ad364e35_10.0.19041.1151_none_cf9de3ecb3a8f61c\r\BrowserCore.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_10.0.19041.264_none_098f3a6c3a48359d\r\printfilterpipelinesvc.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..onentpackagesupport_31bf3856ad364e35_10.0.19041.746_none_3db5b5ee37a4dee7\f\CompPkgSrv.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..mnotificationbroker_31bf3856ad364e35_10.0.19041.746_none_a5ade2e84580e250\DmNotificationBroker.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.19041.1_none_61cd745a990bcfb3\msinfo32.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-klist_31bf3856ad364e35_10.0.19041.1_none_f725ad3465e95fe3\klist.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ices-appcompattools_31bf3856ad364e35_10.0.19041.1_none_a9109d150b1bf064\ROOTDRV.CMD- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_10.0.19041.1_none_f59d207965b1bbc3\InputPersonalization.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..eapplifetimemanager_31bf3856ad364e35_10.0.19041.746_none_45062eb997366a7f\r\RemoteAppLifetimeManager.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-core_31bf3856ad364e35_10.0.19041.1110_none_29d8ec742bfd8b13\r\fhmanagew.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_multimedia-rrinstaller_31bf3856ad364e35_10.0.19041.746_none_f0e6f722ec2403d4\r\rrinstaller.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_windows-defender-offline-amcore_31bf3856ad364e35_10.0.19041.1202_none_b9662ef4fe1412ad\r\OfflineScannerShell.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.19041.1110_none_b678ec2deb73b201\sdchange.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bcdboot-cmdlinetool_31bf3856ad364e35_10.0.19041.1237_none_d618a074f3588a53\r\bcdboot.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.19041.1_none_f58a3da76ed0f251\dsdbutil.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.19041.572_none_42ec0e96ce977bdb\gpscript.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.19041.1_none_c12e5c6c2037e719\imjpuexc.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-metabase_31bf3856ad364e35_10.0.19041.906_none_1756861d80a1f0f5\inetinfo.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.19041.1_none_6e398157aa492263\setup_wm.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\PeopleExperienceHost.exe 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_smsvchost_b03f5f7f11d50a3a_4.0.15805.0_none_6d5f51303f9aca21\SMSvcHost.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.19041.1081_none_7dd23580df04442f\f\DWWIN.EXE- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iechooser_31bf3856ad364e35_11.0.19041.746_none_122a74c9827fe81a\f\IEChooser.exe- 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_669a23c2e08f3cfe4e2181ead63ca523_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1012
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 6.6MB
- SHA256 22c66c96bb27c6cdc15f72b2e8513ab145897da4fc2ba0d544a7de91198c65b8
- MD5 b783a23adf1cc46a152e950ea21b6743
- SHA1 6650dc0400ee89263e0d95979a37c63c39ca746a
- SHA512 f93b0238778003e2a209247554419ca22dab8f61ed1b195ae5516e2ebe12abc844d174d8daf6efde26cdcadb623f6d09bf83f16fe4e36d38a89edd6e0520354a
- SSDEEP 49152:Jx/WPv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dF:PIKUgTH2M2m9UMpu1QfLczqssnKSFjo1
- TLSH T11E66D51165DA9FDCC05FD474CE4669A56A237C468F20AFDF0980BE293E756B06E3820F
- MD5 SHA1 SHA512 SSDEEP TLSH