Analysis
- max time kernel
149s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
01/10/2026, 20:09
Behavioral task
behavioral1
Sample
2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
- Size 19.8MB
- Sample261001-yxe12sys7q
- SHA256 bf13cbcb556baeab5bc062b0b40eb0785ed00810359ea84d92bce876a06756e1
- MD5 ff4f2b971fafd0e55b1f74ad259af7db
- SHA1 332e763ac7570ce6be3e406daf4791efee372ca8
- SHA512 490ffae036234d072a4fd37b36ea3fc9e059ff93653b46bbe7c96350548a649438484d038bb386418b9466280ef8ba7e96ca16c6b22af573c93881ed5f401440
- SSDEEP 393216:ERXMo5zq5THNBpu1Qfc0VTHNBpu1Qfc0e:ERXMo5zq1HNBpu1Qfc0pHNBpu1Qfc0e
- TLSH T14927F712A1978F9DC05FD034CD06A5A156233E498F735BEF69447D68FA366A32E3820F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\CertEnrollCtrl.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\dplaysvr.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\dvdplay.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\iscsicli.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\pcaui.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cmstp.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cmstp.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\mmc.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\OposHost.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\fontview.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\getmac.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\PickerHost.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\powercfg.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\rasphone.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\nslookup.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\perfhost.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\wsmprovhost.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\xwizard.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\ARP.EXE- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\fontview.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\PresentationHost.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\regsvr32.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\schtasks.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\svchost.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\chkntfs.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\fixmapi.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\rekeywiz.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\fontdrvhost.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\LaunchTM.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\fltMC.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cttunesvr.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\regsvr32.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Robocopy.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\TSTheme.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\wevtutil.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\dcomcnfg.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\logagent.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\perfhost.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\scrnsave.scr- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\bootcfg.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cmd.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\ndadmin.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\odbcad32.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\SearchIndexer.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\verifiergui.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\write.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\edpnotify.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\format.com- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe -
resource yara_rule behavioral1/memory/4752-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/files/0x0005000000022bf2-4.dat upx behavioral1/memory/4752-344-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/4752-3212-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Media Player\wmplayer.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Media Player\wmpshare.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Internet Explorer\ielowutil.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\7-Zip\7zG.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_f68db62a3702882b\SearchIndexer.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-office-csp_31bf3856ad364e35_10.0.19041.844_none_9b62a70f9278f2cd\f\ofdeploy.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..up-deviceencryption_31bf3856ad364e35_10.0.19041.1_none_9053c2b542fdf1c3\BitLockerDeviceEncryption.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..ysafety-refreshtask_31bf3856ad364e35_10.0.19041.1266_none_d375b5361b806b32\WpcTok.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi_31bf3856ad364e35_10.0.19041.1_none_613e4ed2b91d35a0\fixmapi.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmpdmc-ux_31bf3856ad364e35_10.0.19041.1_none_a4547e4c96be5f59\WMPDMC.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.19041.1_none_76011176d90c065b\svchost.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.19041.153_none_580ef30a6bb05e53\browserexport.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-certificateinstall_31bf3856ad364e35_10.0.19041.1151_none_ae854961a06058b2\r\dmcertinst.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..b-standardcollector_31bf3856ad364e35_10.0.19041.264_none_0f23d07ed2574292\f\DiagnosticsHub.StandardCollector.Service.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fax-service_31bf3856ad364e35_10.0.19041.804_none_8b46258bdefa0beb\FXSUNATD.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..e-client-ui-wsreset_31bf3856ad364e35_10.0.19041.1_none_7c69077ba55f962b\WSReset.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.262_none_e73f0197262d9fec\TiFileFetcher.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-musnotifyiconexe_31bf3856ad364e35_10.0.19041.153_none_1721bd4ad34c0544\f\MusNotifyIcon.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.19041.844_none_f3894559140c31d7\f\imjpuexc.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.19041.1165_none_1ea3d2b20faf7de3\r\fontdrvhost.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.19041.1_none_ad76f6bb45d8f232\IMJPUEX.EXE- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SystemApps\NcsiUwpApp_8wekyb3d8bbwe\NcsiUwpApp.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-safedocs-main_31bf3856ad364e35_10.0.19041.746_none_03030718c597d891\sdclt.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.19041.546_none_380485edeba9f4c4\SgrmLpac.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\PeopleExperienceHost.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cttune_31bf3856ad364e35_10.0.19041.1_none_697599f55de29ec6\cttune.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..-personalizationcsp_31bf3856ad364e35_10.0.19041.746_none_1eeb97b23978a488\desktopimgdownldr.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recdisc-main_31bf3856ad364e35_10.0.19041.746_none_6275453e12708a76\r\recdisc.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.19041.264_none_8adc8bd8b75d383f\f\UpdateNotificationMgr.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-synchost_31bf3856ad364e35_10.0.19041.746_none_51cf02378fc26da3\SyncHost.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bootconfig_31bf3856ad364e35_10.0.19041.1_none_c2078a8db9a59aef\bootcfg.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..verycenter-platform_31bf3856ad364e35_10.0.19041.153_none_212a5b73f083deb3\SystemResetPlatform.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsselfhealingsvc_31bf3856ad364e35_10.0.19041.746_none_59e1ce71631fef8f\r\WmsSelfHealingSvc.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.19041.1_none_2f8c879e7c6f8b16\rasphone.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-gaming-ga..rnal-presencewriter_31bf3856ad364e35_10.0.19041.1202_none_76e6fb38a70dbd6d\GameBarPresenceWriter.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.19041.964_none_46ba1386f4ce2b0b\f\diskpart.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-safedocs-main_31bf3856ad364e35_10.0.19041.746_none_03030718c597d891\f\sdclt.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..snotificationbroker_31bf3856ad364e35_10.0.19041.153_none_42505a6de732f7ca\r\MusNotification.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SystemApps\Microsoft.AsyncTextService_8wekyb3d8bbwe\Microsoft.AsyncTextService.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tionsnonwinpeplugin_31bf3856ad364e35_10.0.19041.572_none_846686e46b73c8e3\f\PnPUnattend.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_adobe-flash-for-windows_31bf3856ad364e35_10.0.19041.1_none_ebe59bdc3d4ddc3f\FlashPlayerApp.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.264_none_5481650943811810\f\audiodg.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-user-broker_31bf3856ad364e35_10.0.19041.746_none_61e0347e850155a8\UserOOBEBroker.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-safedocs-main_31bf3856ad364e35_10.0.19041.264_none_02eb5d2ec5a9ec02\r\sdclt.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_multimedia-rrinstaller_31bf3856ad364e35_10.0.19041.746_none_f0e6f722ec2403d4\rrinstaller.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1202_none_23a707c9a0b5a8e1\f\Taskmgr.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_49716c2392052aca\r\relog.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.19041.1_none_11b2da2074e7d6e4\Microsoft.AAD.BrokerPlugin.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..onwakesettingflyout_31bf3856ad364e35_10.0.19041.746_none_8a469514405342ff\PasswordOnWakeSettingFlyout.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wordpad_31bf3856ad364e35_10.0.19041.1_none_e3ab86b70c430b3c\wordpad.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.19041.746_none_790f12933fbf7e0d\r\tpmvscmgrsvr.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoftwindows-undockeddevkit.appxmain_31bf3856ad364e35_10.0.19041.488_none_7201e1dc944d1765\r\UndockedDevKit.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.19041.746_none_d22800313aa7eb5c\regedt32.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sensordataservice_31bf3856ad364e35_10.0.19041.746_none_dbfd31e3890afb72\SensorDataService.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-pnp-drvinst_31bf3856ad364e35_10.0.19041.1202_none_ca1e0a7a1f21274c\drvinst.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-atbroker_31bf3856ad364e35_10.0.19041.1_none_8591bd54bdb2be6f\AtBroker.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recdisc-main_31bf3856ad364e35_10.0.19041.84_none_7c1f17a9e1beaf63\recdisc.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.19041.964_none_dddeea757b7fbba7\r\sftp.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.19041.264_none_91c1d6c40350b1b6\appcmd.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_10.0.19041.1266_none_93a0f3defb54e912\f\rdpshell.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.964_none_9a882af90ea09cc3\f\ssh-keygen.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-magnify_31bf3856ad364e35_10.0.19041.1266_none_ed4855448241f7e7\Magnify.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-autoplay_31bf3856ad364e35_10.0.19041.1266_none_9a152e76298cd801\wmlaunch.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\x86_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_10.0.19041.1_none_d31059e0b2fa6d47\aspnet_regiis.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4752
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 20.3MB
- SHA256 e09574925d04934d2d0ee855b6fb2746d907d62cc60d1e075a421e4c429f5012
- MD5 b780b767dfca5c499b1c1ea5b79f0feb
- SHA1 0fc81c2e6ac83d1beeafbd3a8807e9ac2fd8f06c
- SHA512 44831aa22334a56d5a52754a62e29740eb4f50ba6b8e0f3bb342384ba69167fc41cf7afb5d56ef035f30535a65e160baeb67fb169d9721465e29758e926f61c1
- SSDEEP 393216:ERXMo5zq5THNBpu1Qfc0VTHNBpu1Qfc0bl:ERXMo5zq1HNBpu1Qfc0pHNBpu1Qfc0bl
- TLSH T17E270812A1978F99C05FD030CD06A5A196233E498F735BEF69447D68FE366E36A3420F
- MD5 SHA1 SHA512 SSDEEP TLSH