Analysis
- max time kernel
150s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/10/2026, 20:09
Behavioral task
behavioral1
Sample
2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
- Size 19.8MB
- Sample261001-yxe12sys7q
- SHA256 bf13cbcb556baeab5bc062b0b40eb0785ed00810359ea84d92bce876a06756e1
- MD5 ff4f2b971fafd0e55b1f74ad259af7db
- SHA1 332e763ac7570ce6be3e406daf4791efee372ca8
- SHA512 490ffae036234d072a4fd37b36ea3fc9e059ff93653b46bbe7c96350548a649438484d038bb386418b9466280ef8ba7e96ca16c6b22af573c93881ed5f401440
- SSDEEP 393216:ERXMo5zq5THNBpu1Qfc0VTHNBpu1Qfc0e:ERXMo5zq1HNBpu1Qfc0pHNBpu1Qfc0e
- TLSH T14927F712A1978F9DC05FD034CD06A5A156233E498F735BEF69447D68FA366A32E3820F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\attrib.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\dialer.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\RdpSa.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\RMActivate.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\WWAHost.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\fsutil.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\netbtugc.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\proquota.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\replace.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\net1.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\shrpubw.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\dpnsvr.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\efsui.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\recover.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\ttdinject.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\chkntfs.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\nslookup.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\PickerHost.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\TpmTool.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\userinit.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\logman.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\mode.com- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\mtstocom.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\pcaui.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\compact.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\esentutl.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\reg.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\setupugc.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\systeminfo.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\TRACERT.EXE- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Netplwiz.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\PickerHost.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\dccw.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\iexpress.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\ntprint.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cmdkey.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\LaunchTM.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\lodctr.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\newdev.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\sort.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\attrib.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\dxdiag.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\PresentationHost.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\timeout.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Utilman.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\powercfg.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\sethc.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\SndVol.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\sort.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe -
resource yara_rule behavioral2/memory/1108-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x001000000001c531-4.dat upx behavioral2/memory/1108-287-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/1108-2912-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Defender\NisSrv.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Media Player\wmplayer.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\show_third_party_software_licenses.bat- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\dotnet\dotnet.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\7-Zip\Uninstall.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Defender\mpextms.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.26100.1150_none_2a04d71b9e7ba19d\r\mspaint.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_10.0.26100.1591_none_f346527b3b1f36f2\r\BitLockerWizard.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-shutdown-event-tracker_31bf3856ad364e35_10.0.26100.1_none_0a1c6a6364e5546e\shutdown.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_addinprocess32_b77a5c561934e089_10.0.26100.1_none_7e03589d55737e66\AddInProcess32.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-compact_31bf3856ad364e35_10.0.26100.1_none_013d8d7d527fe5d5\compact.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-restartmanager_31bf3856ad364e35_10.0.26100.1_none_877dba7dc10bf8a0\RmClient.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_aspnet_compiler_b03f5f7f11d50a3a_4.0.15912.0_none_75b001d640e3113b\aspnet_compiler.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..dstore-schema-shell_31bf3856ad364e35_10.0.26100.1150_none_2fc55246563e15a2\r\readCloudDataSettings.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.26100.1_none_9609b71ef8d18dee\dfrgui.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.26100.1591_none_a548c43e37f4b89b\r\ie4ushowIE.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.26100.1150_none_50956d2d42f20d39\showmount.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.26100.1150_none_723b9016a5d6336f\printui.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-shellhost_31bf3856ad364e35_10.0.26100.1591_none_e7ad5a201ddffac9\ShellHost.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..commandlinetoolsmqq_31bf3856ad364e35_10.0.26100.1_none_261d19c21491b907\quser.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\csc.exe 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..tegrity-diagnostics_31bf3856ad364e35_10.0.26100.1_none_694d5c871fe6dacc\CIDiag.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.0.26100.1150_none_441b414b1810724c\wextract.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-logagent_31bf3856ad364e35_10.0.26100.1150_none_8727dcae71f2c0a2\r\logagent.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..onalfeatures-fondue_31bf3856ad364e35_10.0.26100.1150_none_e59c5dab3c0f4ed2\Fondue.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-taskhost_31bf3856ad364e35_10.0.26100.1000_none_c42bc74a0a3c26d8\taskhostw.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ilasm.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fontview_31bf3856ad364e35_10.0.26100.1150_none_e04b5db66660ee87\r\fontview.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft.windows.winhttp_31bf3856ad364e35_5.1.26100.1591_none_efe288270f8c9b0b\pacjsworker.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.26100.1_none_a518656df7c165fb\SenseCM.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-webauth_31bf3856ad364e35_10.0.26100.1_none_28969e415f79b32c\AuthHost.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\qprocess.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.26100.1_none_a518656df7c165fb\SenseIR.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-commandprompt_31bf3856ad364e35_10.0.26100.1591_none_31216c35fec422ae\r\cmd.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-iechooser_31bf3856ad364e35_11.0.26100.1_none_c53f9dbf15451292\IEChooser.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-commandline-dsdiag_31bf3856ad364e35_10.0.26100.1150_none_e81654ffadf307a4\dcdiag.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.26100.1591_none_0bc717c8ecd0287d\r\WerFaultSecure.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_msbuild_b03f5f7f11d50a3a_10.0.26100.1_none_ddc589fe5044ffed\MSBuild.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.26100.1591_none_9e1d25f83a6fdbc2\lodctr.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\x86_wpf-terminalserverwpfwrapperexe_31bf3856ad364e35_10.0.26100.1_none_c5344c677bcead1d\TsWpfWrp.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ddodiag_31bf3856ad364e35_10.0.26100.1_none_334a3a73057b472f\ddodiag.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deviceproperties_31bf3856ad364e35_10.0.26100.1_none_e73e0b63a2759f40\DeviceProperties.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.26100.1591_none_479c61fda9b5207c\msinfo32.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..sor-native-whitebox_31bf3856ad364e35_10.0.26100.1150_none_3cdcbfd9e162066d\r\RMActivate.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-autochk_31bf3856ad364e35_10.0.26100.1_none_e93c3ffc5eae7f6f\autochk.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-deployment_31bf3856ad364e35_10.0.26100.1591_none_a2039c43d1b59b62\r\setupugc.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.26100.1591_none_6d1bd4f9d0cbd5f8\r\Robocopy.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ipconfig_31bf3856ad364e35_10.0.26100.1_none_538243b2b4dbfed1\ipconfig.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sethc_31bf3856ad364e35_10.0.26100.1591_none_08d4e4725982e790\EaseOfAccessDialog.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.26100.1591_none_f3f0f30e057f293d\r\mstsc.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1_none_aa346e257779a3b3\TiWorker.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\x86_netfx-csharp_compiler_csc_b03f5f7f11d50a3a_10.0.26100.1_none_a2b84bade0a375ce\csc.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\WFServicesReg.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eudcedit_31bf3856ad364e35_10.0.26100.1150_none_f57fd51c6f680fbc\eudcedit.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_multipoint-wmssvc_31bf3856ad364e35_10.0.26100.1591_none_5c83ef5441ff2734\WmsSvc.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.26100.1591_none_069d7eb507aa0068\r\SearchIndexer.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-commandline-dsmgmt_31bf3856ad364e35_10.0.26100.1150_none_e6bdbe4daedb7df6\dsmgmt.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.26100.1591_none_d64c3d514f37d908\r\IMEPADSV.EXE- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_aspnet_regsql_b03f5f7f11d50a3a_4.0.15912.355_none_cca5d427d5c6dc80\aspnet_regsql.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\x86_netfx-applaunch_exe_b03f5f7f11d50a3a_10.0.26100.1_none_697667281e7cce2c\AppLaunch.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.26100.1591_none_09edd29348b6b707\r\Magnify.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-user-broker_31bf3856ad364e35_10.0.26100.1591_none_1fa6e4d8d638e827\r\UserOOBEBroker.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-muicachebuilder_31bf3856ad364e35_10.0.26100.1_none_2154eeee51c5b168\mcbuilder.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_wcf-m_sm_cfg_ins_exe_31bf3856ad364e35_10.0.26100.1_none_fd15047085b284f0\SMConfigInstaller.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-nslookup_31bf3856ad364e35_10.0.26100.1_none_d2c8c6a3035feb05\nslookup.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-surrogate_31bf3856ad364e35_10.0.26100.1_none_4b6c4168906f5df6\dllhst3g.exe- 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_ff4f2b971fafd0e55b1f74ad259af7db_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1108
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 20.7MB
- SHA256 47e48227b07c04fb31ac1b622598db08e9ff969a36e14dcd4286d1178fe7c8cf
- MD5 86adf7550e6e7dffe90a84da617fdfb6
- SHA1 4739a9b290c1a37c880e983a3f8bba4f90fc44e2
- SHA512 b0caf5392e70007f4d490c93ed84b803ef7bd2bcd93b981a2d07852f14275fad14fe9f15171b8116a7f1bfa79e30527afb57ffa3af23aba9b85be3302de95845
- SSDEEP 393216:ERXMo5zq5THNBpu1Qfc0VTHNBpu1Qfc0i:ERXMo5zq1HNBpu1Qfc0pHNBpu1Qfc0i
- TLSH T16D271812A1978F99C05FD034CD06A5A196233E498F735BDF69447E68FE362E36A3420F
- MD5 SHA1 SHA512 SSDEEP TLSH