Analysis
- max time kernel
150s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/10/2026, 16:50
Behavioral task
behavioral1
Sample
2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe
- Size 5.7MB
- Sample261001-vcan2szdnf
- SHA256 2726c5a146a47c8df4274bf1a0543705d8ded3ea56ee997a1629f66f2fe48395
- MD5 2d39e4cc248c3b7d744ccade5551c45e
- SHA1 ffa814054168694b888689426fcd0ca7d993b3c5
- SHA512 cab73bf3b3aa2a1b4acfc4904afa008160088705ff1865457152b56dfcee6fba9c660d043a89d6947c0b41db670902cd3b44d9574909e4efe78a3cc0a9f23aa2
- SSDEEP 49152:ZD6gqIelOVDTtQY6SoNtaUJ6fUnHpclbwbWAaJiwmqTjcoKVMNuYFMq2qDFzpYqr:Z3qqUHxqPF4VMNP6TUlj
- TLSH T14856E642F213894BD291D934C859D57192213FBD87B345BBFC6CF298FA3B1A36928B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\getmac.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mmgaserver.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Netplwiz.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\reg.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ttdinject.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dxdiag.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\hh.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PATHPING.EXE- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\srdelayed.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\autochk.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\doskey.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dpnsvr.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\find.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\fixmapi.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\tttracer.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\CloudNotifications.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\powercfg.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\setx.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\MuiUnattend.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sdbinst.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\unlodctr.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\format.com- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\fsquirt.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mspaint.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\OpenWith.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\runonce.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sdiagnhost.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\tar.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\iscsicpl.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\notepad.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Utilman.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ndadmin.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\psr.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\rasautou.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sort.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cipher.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dxdiag.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\netsh.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sc.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sdiagnhost.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\OpenWith.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RmClient.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SyncHost.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\print.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\grpconv.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\eudcedit.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe -
resource yara_rule behavioral2/memory/4908-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x000d00000001c629-4.dat upx behavioral2/memory/4908-641-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x000e000000006aac-1113.dat upx behavioral2/memory/4908-2918-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender\MpCopyAccelerator.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\show_third_party_software_licenses.bat- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender\MpCmdRun.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender\NisSrv.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\UndoJoin.bat 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\setup_wm.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\setup_wm.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmpshare.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-certificaterequesttool_31bf3856ad364e35_10.0.26100.1591_none_03d08eaac76f1ba8\certreq.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.26100.1591_none_ffa10fa7b29d4d78\r\hvsiproxyapp.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_10.0.26100.1591_none_f346527b3b1f36f2\r\BitLockerWizardElev.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-takeown_31bf3856ad364e35_10.0.26100.1_none_f6df0e2a7e2ab480\takeown.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-dtc-runtime_31bf3856ad364e35_10.0.26100.1150_none_b53a535c0fece405\msdtc.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.26100.1150_none_04bfb5d145d6cf47\r\diskpart.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netcfg_31bf3856ad364e35_10.0.26100.1150_none_ac162c2f01636f98\r\netcfg.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.26100.1150_none_36fd183d90da21cb\r\tpmvscmgr.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft.workflow.compiler_31bf3856ad364e35_4.0.15912.0_none_ed62602ac24399fc\Microsoft.Workflow.Compiler.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\EdmGen.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\MSBuild.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-utilityvm-setupagent_31bf3856ad364e35_10.0.26100.1150_none_b58f8d0d75fe71dd\r\wcsetupagent.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1150_none_553b538bcf828876\r\mofcomp.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.26100.1_none_42b151b278e19c01\gpupdate.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ment-userdatasource_31bf3856ad364e35_10.0.26100.1150_none_01782765ebe4af77\r\UserDataSource.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.26100.1742_none_fcf4914266c3a69d\ApplyTrustOffline.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-certutil_31bf3856ad364e35_10.0.26100.1591_none_51450313e3636a10\r\certutil.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.26100.1591_none_720b9e48718f9c5a\spoolsv.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.26100.1591_none_41b5bdf47d61c05c\r\SecurityHealthHost.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_wpf-xamlviewer_31bf3856ad364e35_10.0.26100.1_none_5301f4e1e5797d14\XamlViewer_v0300.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.26100.1591_none_7b25a93731217002\r\sdbinst.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..deploymentmgrclient_31bf3856ad364e35_10.0.26100.1150_none_e9952a81b2d9169d\dmclient.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-managedwindowsvm_31bf3856ad364e35_10.0.26100.1591_none_4c3489b778790277\r\ManagedWindowsVM.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.26100.1_none_c299cb2ebf592e77\MpCopyAccelerator.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\PinningConfirmationDialog.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dxp-deviceexperience_31bf3856ad364e35_10.0.26100.1150_none_e30c7c3aa9b12724\Dxpserver.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.26100.1591_none_93c87ba6060f19c7\lodctr.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.26100.1591_none_8feeb08b8bdf7ddb\regedt32.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1_none_065309a92fd714e9\containerworker.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..tnet-mua-hostserver_31bf3856ad364e35_10.0.26100.1150_none_6cd729c157564f7c\r\WinRTNetMUAHostServer.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\r\CBS\SearchHost.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\r\finger.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.26100.1591_none_4593139f0a8d3490\fontdrvhost.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_a73031e9ff1c7610\r\wmplayer.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msaudittools_31bf3856ad364e35_10.0.26100.1150_none_b36c622d6cabda77\auditpol.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1150_none_fd0acb47aebf06db\tracerpt.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.26100.1150_none_fb078fe8106f7572\r\cmstp.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-certutil_31bf3856ad364e35_10.0.26100.1591_none_5b99ad6617c42c0b\certutil.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInUtil.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\DeploymentAgent.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9ce862b2367e1d00\AppResolverUX.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.26100.1591_none_97b3f064acd38654\SecureAssessmentBrowser.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.26100.1591_none_6c3d16dfebe198e3\SndVol.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.26100.1591_none_ca90d4b7666bc2e5\r\appidtel.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.26100.1150_none_e04006fcf72e00e6\eshell.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..eak-diagnostic-core_31bf3856ad364e35_10.0.26100.1150_none_f6f8f37a2d4c3113\r\rdrleakdiag.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.26100.1591_none_805965242ec082f4\r\LsaIso.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_netfx35linq-addinutil_31bf3856ad364e35_10.0.26100.1_none_c811e1884be875a8\AddInUtil.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_netfx4-ngen_exe_b03f5f7f11d50a3a_4.0.15912.100_none_aaf04994419917f0\ngen.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.26100.1591_none_9a435addc0403fd6\regedit.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Ldr64.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-unlock_31bf3856ad364e35_10.0.26100.1_none_61895966950582dc\bdeunlock.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.26100.1150_none_3a3e93ee89e96c57\UpgradeResultsUI.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-commandline-dsdiag_31bf3856ad364e35_10.0.26100.1150_none_e81654ffadf307a4\dcdiag.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-csp_31bf3856ad364e35_10.0.26100.1591_none_83cfa386bbdf1361\hvsievaluator.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..agespaces-spaceutil_31bf3856ad364e35_10.0.26100.1591_none_782468f07f32b467\spaceutil.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-taskhost_31bf3856ad364e35_10.0.26100.1000_none_c42bc74a0a3c26d8\r\taskhostw.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.26100.1742_none_b56d38775a1eaac9\r\mmc.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.26100.1_none_41438fbea643a6b2\odbcad32.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..ssociationframework_31bf3856ad364e35_10.0.26100.1591_none_4606dbfb8b0028fd\r\dasHost.exe- 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-30_2d39e4cc248c3b7d744ccade5551c45e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4908
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 6.6MB
- SHA256 bb4b9e05f9f9b42c0c70ee7e146a58274d2a3efdc2b6d0b7fccfbd0db3fe1746
- MD5 45926f33959c9b2c94d70cee9ffaf3e5
- SHA1 9c5ade01329876483b51b081f86f027575697004
- SHA512 d16a6e7ce045c1a35bf3ff7ee222fc8187e9aa61176aff81955b5317fa9e056920627468fd19ba26d7de1cd18fb16a4642a51dfbb30063906c33d3b71714002b
- SSDEEP 49152:ZD6gqIelOVDTtQY6SoNtaUJ6fUnHpclbwbWAaJiwmqTjcoKVMNuYFMq2qDFzpYqW:Z3qqUHxqPF4VMNP6TUlYezSC6v2XMHF
- TLSH T1BC660702F2238A5BD191C534C4559571E6313BAD87B345FBFC5CF298FA3B1A3A928B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\DismountPing.bat-
- Size 6.6MB
- SHA256 fcafc5d396c0784c93f8648280330d764755418d8b358f697710e388c309e476
- MD5 7a62cf189d7aec6e701c91cbf191394b
- SHA1 a3f6ae742b2b8ad030281c3237c29b8bd78e7078
- SHA512 88af20d06528456aa095ca28566a074740a2f3dddd077d3b1142db2fc3f048c816baebeb4403d304917904cefd89555e9006845c8390ed1ec6ddb0507d237913
- SSDEEP 98304:Z3qqUHxqPF4VMNP6TUlJlqVZ+8donO/HRp:ZaHxXMZ64lbWon6
- TLSH T144661842F213894BD291D934C859D57192213FBD87B345BBFC6CF298FA3B1A36928A11
- MD5 SHA1 SHA512 SSDEEP TLSH