Analysis
- max time kernel
149s - max time network
134s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/10/2026, 05:10
Behavioral task
behavioral1
Sample
2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe
- Size 31.0MB
- Sample261024-ft2frsec76
- SHA256 94b270b9bd7dd386c76bb71023cce88b16fa34fa178dd05034028f1c6f719d50
- MD5 8df09bc34bdb00fe2764e44a5aa47cc7
- SHA1 a997c90918aef3b3809b1599d15ff0c4d9a96d44
- SHA512 17bd6791054e78ae0e32c26324c3d7e6bfdf1bcb8ffd175f348b5a62786ec5d76b2a40002ee6739370991a02fcb42d3b62400e276c94a54f21d669d04a871ae5
- SSDEEP 49152:yxElovxB92F7VBXdcD/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vm:VleB6XdLWQtZ/K0tGOFWVRuLftCTp
- TLSH T1C2675B13F6E540A9E0AAD278CE358731AB327C554BF1A5DF229036D42F72AD07B38725
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\InfDefaultInstall.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\mstsc.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\wowreg32.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\certutil.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\control.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\iexpress.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\svchost.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\dllhost.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\logman.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\mmgaserver.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\poqexec.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\taskkill.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\bitsadmin.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\dpapimig.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\proquota.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\winrm.cmd 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cliconfg.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\driverquery.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\ntprint.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\provlaunch.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\autochk.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\autoconv.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\diskpart.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\finger.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\mode.com- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\raserver.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\hdwwiz.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\user.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\w32tm.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\replace.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\WWAHost.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cmd.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\lodctr.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\certreq.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\choice.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Fondue.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\fsquirt.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\iscsicpl.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\takeown.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cttunesvr.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\dllhst3g.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\icsunattend.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\NETSTAT.EXE- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe -
resource yara_rule behavioral1/memory/4084-0-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/files/0x0003000000022b79-4.dat upx behavioral1/memory/4084-239-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/4084-238-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/4084-582-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/4084-915-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/4084-1213-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/4084-1456-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/4084-1697-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/4084-1926-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/4084-2151-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/4084-2364-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/4084-2581-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/4084-2804-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/4084-3051-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/4084-3234-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/4084-3235-0x0000000000400000-0x000000000040F000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Windows Media Player\setup_wm.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Windows Mail\wabmig.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Windows Media Player\setup_wm.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Windows Media Player\wmprph.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-efs-ui_31bf3856ad364e35_10.0.19041.1_none_ac65d58626f4027c\efsui.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ieframe_31bf3856ad364e35_11.0.19041.264_none_863c21753674f968\IESettingSync.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..player-shellpreview_31bf3856ad364e35_10.0.19041.1_none_768ee0b51294e72b\wmprph.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unattendedjoin_31bf3856ad364e35_10.0.19041.572_none_90e9bab3cbbfd71a\djoin.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.1_none_fbaeb6d5afb287f7\gpresult.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-c..periencehost-broker_31bf3856ad364e35_10.0.19041.746_none_1ce3c0f12fb5f8ec\f\CloudExperienceHostBroker.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.19041.746_none_b8eadbf8a9c907b3\psr.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..crosoftedgedevtools_31bf3856ad364e35_10.0.19041.1_none_65a5646e8443d0f8\MicrosoftEdgeDevTools.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcore_31bf3856ad364e35_10.0.19041.1151_none_21b291c4f7bdb6e0\f\nfsclnt.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1081_none_2e31e8eed4b770c3\f\mofcomp.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-es-authentication_31bf3856ad364e35_10.0.19041.1_none_02027476ea57232f\EhStorAuthn.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..llshield-wow64-main_31bf3856ad364e35_10.0.19041.1_none_245e11de2a010b62\setup.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.19041.1_none_0f750b10a0559386\IMTCPROP.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_10.0.19041.844_none_64d33f8fb364398c\r\net1.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pickerhost_31bf3856ad364e35_10.0.19041.1_none_639e78e5edb8f409\PickerHost.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ribbons_31bf3856ad364e35_10.0.19041.1_none_3ea5f185c75971c2\Ribbons.scr- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smss-minwin_31bf3856ad364e35_10.0.19041.964_none_5c42846f47acb1a6\smss.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-complus-ui_31bf3856ad364e35_10.0.19041.746_none_8ea10e81a707d623\dcomcnfg.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..up-deviceencryption_31bf3856ad364e35_10.0.19041.1202_none_4f22e21b58d6c2e3\r\BitLockerDeviceEncryption.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_9aa166e99861c2bc\query.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.19041.928_none_6a67731cf3e151f2\f\pcaui.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-convert_31bf3856ad364e35_10.0.19041.1266_none_1befc89391e44c23\f\autoconv.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.19041.84_none_9b0dd648f2c31f16\r\dfrgui.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.19041.1202_none_3594628932065f23\f\wevtutil.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..deploymentmgrclient_31bf3856ad364e35_10.0.19041.1202_none_c26e06f4b82585b5\r\dmclient.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-extcom_31bf3856ad364e35_10.0.19041.84_none_027c502c6e331223\SppExtComObj.Exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.964_none_9a882af90ea09cc3\r\ssh-add.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.964_none_9a882af90ea09cc3\ssh-add.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-convert_31bf3856ad364e35_10.0.19041.1266_none_1befc89391e44c23\convert.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.19041.1202_none_27f9f931a79d1cbe\mavinject.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..ectionflow.appxmain_31bf3856ad364e35_10.0.19041.423_none_0b0196a3d38fda4e\r\OOBENetworkConnectionFlow.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_3f1cc1d15da468cf\logman.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux_31bf3856ad364e35_10.0.19041.264_none_39a33f9dfdb389ae\slui.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiFileFetcher.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ices-appcompattools_31bf3856ad364e35_10.0.19041.1_none_a9109d150b1bf064\SETPATHS.CMD- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.19041.964_none_dddeea757b7fbba7\r\sftp.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\WsatConfig.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\EdmGen.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\AccountsControlHost.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.19041.1266_none_3bcd0306a19592e2\f\Robocopy.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-klist_31bf3856ad364e35_10.0.19041.1266_none_b5fa73367bbd2f91\r\klist.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.19041.84_none_29cf9b86db5fb249\Setup.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.19041.264_none_8adc8bd8b75d383f\UpdateNotificationMgr.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-autochk_31bf3856ad364e35_10.0.19041.1266_none_610e6b21ab533b13\r\autochk.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.FilePicker_cw5n1h2txyewy\FilePicker.exe 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.19041.746_none_a8b46aaa6c07ca3d\f\CredentialUIBroker.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.19041.423_none_6c3451a09cba3850\r\AccountsControlHost.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ervicing-management_31bf3856ad364e35_10.0.19041.844_none_3ca0ef366c7d7a84\n\Dism.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicesetupmanagerapi_31bf3856ad364e35_10.0.19041.746_none_55af03e86cb19d55\DsmUserTask.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-choice_31bf3856ad364e35_10.0.19041.1_none_83aca2e25f8134a1\choice.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.1081_none_ef39acce2648e404\r\WerFaultSecure.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mdmagent_31bf3856ad364e35_10.0.19041.1_none_faedbaa2bd7d01c2\MDMAgent.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..verycenter-platform_31bf3856ad364e35_10.0.19041.964_none_21209b01f08afd33\SystemResetPlatform.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.1_none_6e0e425bd0e83959\shrpubw.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.19041.1_none_4a6487592c595dd4\mpnotify.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.264_none_583d67d6d00b6b6a\WerFault.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-tetheringservice_31bf3856ad364e35_10.0.19041.1_none_43a1294286598aee\IcsEntitlementHost.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fax-service_31bf3856ad364e35_10.0.19041.804_none_8b46258bdefa0beb\r\FXSUNATD.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.1202_none_7cdad2e52790705d\r\hvsirdpclient.exe- 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_8df09bc34bdb00fe2764e44a5aa47cc7_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4084
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 31.5MB
- SHA256 4b7099744a260e9721a0fd1fcceb31d47b9f232a6d13b7efe22e8406fb1137c5
- MD5 55331185c1f1fd7d5848f06f8a2ac388
- SHA1 2a7c849a7fa4efaa094c21d61be4adaedcde34fe
- SHA512 014e417e5e8906da4be2060c71e145300ed4082c71350ff625cd18220c76d20b973454973ef122c65cc81608eaade8f6499189e1822b6f903da8e097bb9cc32d
- SSDEEP 49152:yxElovxB92F7VBXdcD/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vR:VleB6XdLWQtZ/K0tGOFWVRuLftCT9jot
- TLSH T1BE776B13F2A481A9E0AAD178CE759721EB327C554BF1A5DF228076D42F33AD07B39721
- MD5 SHA1 SHA512 SSDEEP TLSH