Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/08/2026, 12:33
Behavioral task
behavioral1
Sample
2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe
- Size 1.2MB
- Sample260827-prphvshe78
- SHA256 a612ee22406272d3430237de12d1d52a5ab145558ee599c5b4f7a9b6b324279f
- MD5 93817f5d4c51eaa456bd0b64aa6a519b
- SHA1 88b4ad492f0b1009600fc2421e5792335fef9383
- SHA512 b2449dbc554a1cc7f2d782a3bb06293ba0ec81bd71cd955cef0da27f570424e64dbe8f9445c2f85799c88540c135f9fc407d5637f81b684d8b3c17cf5b9bb2b0
- SSDEEP 24576:BLKfhIClyBZGFQn652EdCeJVJTt4D7/SAOZi+5v48cKfs:BuyBZ92bVBXdcF
- TLSH T111456B47F69419B9D06BD23886579722FA327C090B32EBCF139892352E277E05F39764
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\icacls.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mstsc.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\perfhost.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dxdiag.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\msiexec.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\msra.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\raserver.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sethc.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wiaacmgr.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\write.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\eudcedit.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\help.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RmClient.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\expand.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\resmon.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\clip.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cscript.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\recover.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\regedit.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\setx.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Magnify.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mavinject.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\more.com- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cmdkey.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dcomcnfg.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\fsutil.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ktmutil.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PkgMgr.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\psr.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\schtasks.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\appidtel.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\certreq.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cmd.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\finger.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SecEdit.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\secinit.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\tttracer.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\auditpol.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\extrac32.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\fixmapi.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\srdelayed.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\print.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\proquota.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dfrgui.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\verclsid.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\winrm.cmd- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\bootcfg.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ctfmon.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\regini.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SyncHost.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe -
resource yara_rule behavioral1/memory/3772-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/files/0x000a0000000004e9-5.dat upx behavioral1/memory/3772-1315-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/3772-3216-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\bin\rmid.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\BlockReceive.cmd- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\show_third_party_software_licenses.bat 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows NT\Accessories\wordpad.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\7-Zip\7zG.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-whoami_31bf3856ad364e35_10.0.19041.1_none_846d8bda2133af3c\whoami.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.19041.1081_none_f28ba6a10743aebc\SpeechModelDownload.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-inputredirection_31bf3856ad364e35_10.0.19041.1_none_ba15c535035058c0\rdpinput.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-openwith_31bf3856ad364e35_10.0.19041.1_none_2d66868246722e10\OpenWith.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventcollector_31bf3856ad364e35_10.0.19041.662_none_d8ed4acdd3960fad\r\wecutil.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapphost_31bf3856ad364e35_10.0.19041.1_none_b19798c3028c2929\LockAppHost.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_3f1cc1d15da468cf\r\typeperf.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-unlock_31bf3856ad364e35_10.0.19041.746_none_428efbd28b482d1c\r\bdeunlock.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_netfx-mscorsvw_exe_b03f5f7f11d50a3a_10.0.19041.1_none_99318cb064fcaf44\mscorsvw.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-u..onwakesettingflyout_31bf3856ad364e35_10.0.19041.746_none_949b3f6674b404fa\r\PasswordOnWakeSettingFlyout.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1202_none_23a707c9a0b5a8e1\LaunchTM.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-complus-ui_31bf3856ad364e35_10.0.19041.746_none_8ea10e81a707d623\dcomcnfg.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.19041.1_none_9064b8c1b47576c0\iscsicli.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-snippingtool-app_31bf3856ad364e35_10.0.19041.746_none_77bd4cfbe87238a7\f\SnippingTool.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wusa_31bf3856ad364e35_10.0.19041.1151_none_2c2550df02273de3\f\wusa.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-thumbexthost_31bf3856ad364e35_10.0.19041.746_none_d8baedf8d09aba05\r\ThumbnailExtractionHost.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.19041.264_none_d58a0ca50a94510c\vmcompute.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi_31bf3856ad364e35_10.0.19041.423_none_895925637881788e\r\fixmapi.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft.windows.winhttp_31bf3856ad364e35_5.1.19041.264_none_7517ff6e147bc8a9\f\pacjsworker.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\OOBENetworkConnectionFlow.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-d..ectxdatabaseupdater_31bf3856ad364e35_10.0.19041.84_none_2d21e26a18d595c7\directxdatabaseupdater.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-where_31bf3856ad364e35_10.0.19041.1_none_1e18f0f5b1e8db7d\where.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-assignedaccess-guard_31bf3856ad364e35_10.0.19041.844_none_10a0a60f1ec9cc10\n\AssignedAccessGuard.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_regsvcs_b03f5f7f11d50a3a_4.0.15805.0_none_8ce1f3b4679d3a76\RegSvcs.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dataexchangehost_31bf3856ad364e35_10.0.19041.264_none_c765d8a6c76ec25f\DataExchangeHost.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ngc-trustlet_31bf3856ad364e35_10.0.19041.84_none_dd81fb99bc3b1e53\f\NgcIso.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speechcommonnoia64_31bf3856ad364e35_10.0.19041.1_none_b89a948362edb3e7\sapisvr.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.19041.1266_none_07a5d18b92d8b668\r\cmimageworker.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wsl_31bf3856ad364e35_10.0.19041.117_none_610933d42d963a44\wsl.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.19041.1266_none_22b99d078bbc3016\unregmp2.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..sktop.appxmain.root_31bf3856ad364e35_10.0.19041.1266_none_3e00d223332897b8\r\SearchApp.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_10.0.19041.1266_none_e488d49c8a22d21e\winlogon.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.1_none_36e57bfcb85e0850\SpatialAudioLicenseSrv.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.19041.572_none_4d40b8e902f83dd6\r\gpscript.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..ing-platform-client_31bf3856ad364e35_10.0.19041.1_none_bf56a5e7532d9c79\licensingdiag.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..lity-eoaexperiences_31bf3856ad364e35_10.0.19041.153_none_c283d2cf01b0b7d8\EoAExperiences.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.19041.1081_none_737d8b2eaaa38234\r\DWWIN.EXE- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-core_31bf3856ad364e35_10.0.19041.1110_none_29d8ec742bfd8b13\fhmanagew.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..nsemanager-shellext_31bf3856ad364e35_10.0.19041.746_none_9043799a93dba365\f\LicenseManagerShellext.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..sionagent-uachelper_31bf3856ad364e35_10.0.19041.1_none_7aff9045397d4a4c\RdpSaUacHelper.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_wpf-terminalserverwpfwrapperexe_31bf3856ad364e35_10.0.19041.1_none_7e31b18ab29f9913\TsWpfWrp.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dfsvc.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\msil_dfsvc_b03f5f7f11d50a3a_10.0.19041.1_none_26b5e44019fe7ae2\dfsvc.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\r\AppVStreamingUX.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-calc_31bf3856ad364e35_10.0.19041.1_none_5faf0ebeba197e78\calc.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.19041.1_none_233543e4fce957ae\cleanmgr.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.19041.264_none_223a5768a6257099\CustomShellHost.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-starttiledata_31bf3856ad364e35_10.0.19041.1202_none_05856bbd8f935e6b\f\DataStoreCacheDumpTool.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.19041.1_none_e8b8012dee3ba92e\finger.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ng-server-isolation_31bf3856ad364e35_10.0.19041.746_none_7aa85dbabd7172c7\PrintIsolationHost.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.19041.746_none_7a0308f7ffc334d5\resmon.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-n..setup-compatibility_31bf3856ad364e35_10.0.19041.1_none_3067f23752280fbc\NetCfgNotifyObjectHost.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_comsvcconfig_b03f5f7f11d50a3a_4.0.15805.0_none_468e01fabfc37212\ComSvcConfig.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_ec390bd802a1c630\r\SearchFilterHost.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1288_none_71734bf99a2a6955\UevAppMonitor.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.19041.1288_none_e0f8082a6952ce81\r\ntoskrnl.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip_31bf3856ad364e35_10.0.19041.1_none_1776a3602eb73133\netiougc.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..player-shellpreview_31bf3856ad364e35_10.0.19041.1266_none_3fb851095cc978d4\wmprph.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-refsutil_31bf3856ad364e35_10.0.19041.1202_none_5f774093e49b3593\refsutil.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.1237_none_c77fb947e9eed73b\cscript.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\NarratorQuickStart.exe 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.906_none_198d8d483aa30ed0\gpresult.exe- 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-27_93817f5d4c51eaa456bd0b64aa6a519b_akira_elex_hijackloader_icedid_njrat_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3772
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 1.7MB
- SHA256 46ef6f2124350966bbe0d51771bcfcb77739f7d776758715c53be8b6ebbd50c4
- MD5 ea55ebfb5cb5b7ee3d1000b546d8a6f7
- SHA1 4bd7f75f9fce6cf0787fd10132a096d2105ef4d2
- SHA512 cdca700b03b0defc669438d8c782d3f157513a85f9cb37f1df7626108f541f4bb68592494b3b9db185597b5667bbdcd4cbc1af375d6b7b53f3e7bad39ea8f416
- SSDEEP 24576:BLKfhIClyBZGFQn652EdCeJVJTt4D7/SAOZi+5v48cKf20Le5ji0hmxNrMx:BuyBZ92bVBXdcRPji0Aj0
- TLSH T1DF856B16F6A44AB5D077D279C6939716FA3238450B31DBCB038897393E277E19E3A720
- MD5 SHA1 SHA512 SSDEEP TLSH