Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 15:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
- Size 15.1MB
- Sample261002-sdkjjascra
- SHA256 63fbb0a2acd9563c27618e655588e9ed361181cf99ee61a01789e03fb18ed81a
- MD5 4e79fa1c04060a3b8f2549e251ebc1a9
- SHA1 9e99aa255c7532ae4eb224ba00e7eee082fdd576
- SHA512 5f230835d23de037ea30b3f4dd9f5bedd6a84b51d1f070fc1d1ce2839c52cb58a6bd7e732e0a29e19dd80347462d35e23ab9dad7d6c9e0787d9cc11ae6837c23
- SSDEEP 196608:BjrOOwH+v/d12RNRdW18U5gTH2qBpu1QfLIqsufvJ6l:BjrOB+u8aTHNBpu1Qfc0Ql
- TLSH T11DF6F81166D98FE8C05FD474CE4665A59A237C868F20AFDF0980BE293E766F05E3421F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\charmap.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\icsunattend.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\ndadmin.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\OposHost.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\printui.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\TapiUnattend.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\fltMC.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\mode.com 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\prevhost.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\systray.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\tcmsetup.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\verifiergui.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\w32tm.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\calc.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\iexpress.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\mshta.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\NETSTAT.EXE 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\powercfg.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\provlaunch.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\rasdial.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\ARP.EXE- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\attrib.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\tzutil.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\doskey.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\mmc.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\rekeywiz.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\w32tm.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\wscript.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\credwiz.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\ipconfig.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\isoburn.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\mmc.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\msdt.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\odbcconf.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\takeown.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\waitfor.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\icacls.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\runonce.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\stordiag.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\charmap.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\curl.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\ddodiag.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\pcaui.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\regsvr32.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\cmdkey.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\dxdiag.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\efsui.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\fc.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\netiougc.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Windows Media Player\wmplayer.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Windows Defender\MpCmdRun.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Mozilla Firefox\firefox.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Windows Media Player\wmpshare.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-update-uus-core-ux_31bf3856ad364e35_10.0.26100.1591_none_8f2563a7ac59897b\MoNotificationUxStub.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.26100.1591_none_815687268bc7e515\r\WindowsSandbox.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.26100.1150_none_49db19f88674c270\r\setup_wm.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tpm-tool_31bf3856ad364e35_10.0.26100.1591_none_99f9c6049c838786\r\TpmTool.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-label_31bf3856ad364e35_10.0.26100.1_none_5e775e7a6735dc2c\label.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.26100.1591_none_37fa9a7337d181ee\uwfservicingscr.scr- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcmdtools_31bf3856ad364e35_10.0.26100.1150_none_ed4ab399a05c1619\umount.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..client-ui-wscollect_31bf3856ad364e35_10.0.26100.1_none_06a70fed9a123232\WSCollect.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\TCPSVCS.EXE- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-openfiles_31bf3856ad364e35_10.0.26100.1_none_ee6eb9b387518683\openfiles.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-winhstb_31bf3856ad364e35_10.0.26100.1_none_304e610ba6542e51\winhlp32.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.FileExplorer_cw5n1h2txyewy\FileExplorer.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-apprep-chxapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d0c423c229a48e\CHXSmartScreen.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audit-component_31bf3856ad364e35_10.0.26100.1_none_a3abe7a4df6b292a\audit.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wsl_31bf3856ad364e35_10.0.26100.1150_none_1ed5d4d47eca0768\r\wsl.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.26100.1591_none_6d1bd4f9d0cbd5f8\Robocopy.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1000_none_5f95cc5803dfafcd\r\mofcomp.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1_none_aa346e257779a3b3\containerworker.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\SnapLauncherProtocol.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-csp_31bf3856ad364e35_10.0.26100.1591_none_83cfa386bbdf1361\hvsievaluator.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-edp-notify_31bf3856ad364e35_10.0.26100.1591_none_c6e1de18243de2ea\edpnotify.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eudcedit_31bf3856ad364e35_10.0.26100.1_none_60e0d7585c6b83b9\eudcedit.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1591_none_989a65f2aef55b28\r\ShellExperienceHost.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\msil_datasvcutil_b77a5c561934e089_10.0.26100.1_none_6ea9e81d0ca2fc8b\DataSvcUtil.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..llercommandlinetool_31bf3856ad364e35_10.0.26100.1_none_7bb68dcb719a0f10\sc.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-charmap_31bf3856ad364e35_10.0.26100.1591_none_8e19b8855461fe2c\r\charmap.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_netfx-csharp_compiler_csc_b03f5f7f11d50a3a_10.0.26100.1_none_5b0b14d6cc274cc8\csc.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.26100.1591_none_4ab0905276b69755\r\CheckNetIsolation.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msdt_31bf3856ad364e35_10.0.26100.712_none_51f923c23ace47fd\r\msdt.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-netsh_31bf3856ad364e35_10.0.26100.1_none_66e948f094c62ed2\netsh.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-shell-previewhost_31bf3856ad364e35_10.0.26100.1_none_4a85b7d59dcc025f\prevhost.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-xwizard-host-process_31bf3856ad364e35_10.0.26100.1_none_603c6385d5714700\xwizard.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.26100.1_none_11a8c65c8f61d5fb\dpnsvr.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-regini_31bf3856ad364e35_10.0.26100.1_none_0949e4cf225d7e03\regini.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runonce_31bf3856ad364e35_10.0.26100.1591_none_b17acfc36f0ec944\r\runonce.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1301_none_970881ba6260e29a\r\StartMenuExperienceHost.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-bootexp_31bf3856ad364e35_10.0.26100.1150_none_6548a7f0b3a3e4e1\r\BootExpCfg.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapphost_31bf3856ad364e35_10.0.26100.1591_none_97668666133579f2\r\LockAppHost.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sqm-consolidator-base_31bf3856ad364e35_10.0.26100.1_none_d1331449ca23b444\wsqmcons.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.26100.1_none_b0d3de420cfbf405\appcmd.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-legacyhwui_31bf3856ad364e35_10.0.26100.1150_none_7e5b72d9f82ad1d1\hdwwiz.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.26100.1_none_6c61929e721b6ffa\fsquirt.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wpd-shellextension_31bf3856ad364e35_10.0.26100.1301_none_b74a2f61ab292fb3\r\WPDShextAutoplay.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..management-omadmprc_31bf3856ad364e35_10.0.26100.1150_none_51b04101eb60b5d4\r\omadmprc.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_wcf-wsatconfig_b03f5f7f11d50a3a_10.0.26100.1_none_a7b1b2421ae9ec27\WsatConfig.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_b184dc3c337d380b\r\wmplayer.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.AppResolverUX_cw5n1h2txyewy\AppResolverUX.exe 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapp.appxmain_31bf3856ad364e35_10.0.26100.1591_none_83300daf83f8b2a6\LockApp.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mystify_31bf3856ad364e35_10.0.26100.1150_none_8bf8eb890f472d80\Mystify.scr- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_netfx4-servicemodelreg_exe_b03f5f7f11d50a3a_4.0.15912.0_none_cee89c9eae78ac91\ServiceModelReg.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.26100.1_none_c299cb2ebf592e77\MpCopyAccelerator.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..mpropertiesadvanced_31bf3856ad364e35_10.0.26100.1_none_fe90da8a8133c864\SystemPropertiesAdvanced.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\NETSTAT.EXE- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.26100.1150_none_160ad4e2bcc0210f\r\browser_broker.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-feedsbs_31bf3856ad364e35_11.0.26100.1150_none_dbed5373b4208431\r\msfeedssync.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.26100.1591_none_bd195c301c7f4e60\lpksetup.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-tool-exe_31bf3856ad364e35_10.0.26100.1_none_f70e66181fe2eced\manage-bde.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-control_31bf3856ad364e35_10.0.26100.1_none_a0b44bf0476b30ed\control.exe- 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_4e79fa1c04060a3b8f2549e251ebc1a9_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4404
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 16.0MB
- SHA256 8f80c61f6aeba4d1f2b278a139e12155b07e334c45d35b798f4f043a4f482627
- MD5 59aea9d9b56d995dac23245beacce33b
- SHA1 c96f102f82d0e66c890d3d292c513115f635585c
- SHA512 4c36613f5876547f997f87180ccd8f90d95cd27f27f5bd7bb3edc6110419ec7e413c8433c5b60ba688d944ff9f1eba8cb5451c08cd8fd0d097da8c36c06382d4
- SSDEEP 196608:BjrOOwH+v/d12RNRdW18U5gTH2qBpu1QfLIqsufvJ6xz:BjrOB+u8aTHNBpu1Qfc0Qd
- TLSH T184F6F71165D98FE8C05FD074CE4665A6AA237C868F209FDF0980BE293E766F05E3521F
- MD5 SHA1 SHA512 SSDEEP TLSH