Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/11/2026, 11:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 3.8MB
- Sample261110-np4pbsswev
- SHA256 8f28b8803653ca5637137f9cf4313dbb50bddb8c3367973bb08dee486d03102f
- MD5 b0425ceaa128a7c01664cd4176a3dc5e
- SHA1 99f8a5bf58b1a8bda446cefdb7dc97e5bf69cc22
- SHA512 4281f864355114e7f608a33167e56540c1f6d5e5631637e8baf5f1457f8c547892ecc799bbe47dd73f4d745d67bd31e34976055c2d5cb63797ce32935d5f24c6
- SSDEEP 49152:kdJDp5O+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkySpYqN:kTzP0oAaldmdmnpS6O
- TLSH T1B9165903A65449E9D056C074CE628622EB713C4D47F1A6EF3294BAEA3E73AD03F39751
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\sxstrace.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\regedit.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\chkdsk.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\explorer.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\extrac32.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\makecab.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\WerFault.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\curl.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\dllhost.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\RmClient.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\SndVol.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\WWAHost.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\xcopy.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\netsh.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\NETSTAT.EXE- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\PATHPING.EXE 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\rasautou.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\where.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\mfpmp.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\rasautou.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\TapiUnattend.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\wusa.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\fixmapi.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\forfiles.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\grpconv.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\label.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\pcaui.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\logagent.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\sdchange.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\attrib.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\cmd.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\extrac32.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\grpconv.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\mavinject.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\netiougc.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\typeperf.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\esentutl.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\fsutil.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\compact.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\getmac.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\SyncHost.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\systeminfo.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\TSTheme.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\MuiUnattend.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\wscript.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\curl.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\mobsync.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\shrpubw.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\dpnsvr.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Windows Defender\MpCmdRun.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\updater.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Defender\NisSrv.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Mail\wabmig.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\7-Zip\7zG.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-edge-webview_31bf3856ad364e35_10.0.26100.1_none_8fe1c356f34a19ca\show_third_party_software_licenses.bat- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\r\UevAppMonitor.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-attrib_31bf3856ad364e35_10.0.26100.1_none_af81c311f4c11a95\attrib.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-srdelayed_31bf3856ad364e35_10.0.26100.1_none_53510033c4b43552\srdelayed.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-workspaceruntime_31bf3856ad364e35_10.0.26100.1150_none_c24c8b338d2c21f3\wksprt.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\LogonWebHostProduct.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.26100.1742_none_cbf6967615a0f1cb\hvax64.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..al-chinese-moimeexe_31bf3856ad364e35_10.0.26100.1150_none_cd32a881f6fe4738\r\ChtIME.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-office-csp_31bf3856ad364e35_10.0.26100.1150_none_5952ab67e391cc12\ofdeploy.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.26100.1150_none_1da178eaf53e7c4d\PrintBrm.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wifinetworkmanager_31bf3856ad364e35_10.0.26100.1591_none_087ed6682bae0fd0\wifitask.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-atbroker_31bf3856ad364e35_10.0.26100.1591_none_75b5554a02bcd133\AtBroker.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SystemApps\Windows.CBSPreview_cw5n1h2txyewy\CameraBarcodeScannerPreview.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fodhelper-ux_31bf3856ad364e35_10.0.26100.1150_none_ced6ba8820394f22\fodhelper.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-forfiles_31bf3856ad364e35_10.0.26100.1_none_5c6bc2527a7626ca\forfiles.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\x86_msbuild_b03f5f7f11d50a3a_3.5.26100.1_none_3b94e354cf3fab21\MSBuild.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.26100.1591_none_37fa9a7337d181ee\r\uwfservicingscr.scr- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\SecureAssessmentBrowser.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..l-systemuwplauncher_31bf3856ad364e35_10.0.26100.1150_none_a0f2e25475ab99da\SystemUWPLauncher.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_a73031e9ff1c7610\r\wmpconfig.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-storage-refsdedupsvc_31bf3856ad364e35_10.0.26100.1591_none_739bd7d2b0e92fb8\ReFsDedupSvc.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.26100.1591_none_f3f0f30e057f293d\mstsc.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.26100.1591_none_70d0fee4fcc0ae07\sdbinst.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.26100.1591_none_d3181252b1eca58b\msra.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..onwakesettingflyout_31bf3856ad364e35_10.0.26100.1150_none_48349abe916de6bd\r\PasswordOnWakeSettingFlyout.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.26100.1591_none_41b5bdf47d61c05c\r\SecurityHealthHost.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\vbc.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.26100.1150_none_4518f57e3fc4b0d8\PING.EXE- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..on-filedialogbroker_31bf3856ad364e35_10.0.26100.1150_none_76334e5b2ee0ae62\r\FileDialogBroker.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-shellhost_31bf3856ad364e35_10.0.26100.1591_none_e7ad5a201ddffac9\ShellHost.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1_none_686bcd839bc27ad8\tracerpt.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\r\SyncAppvPublishingServer.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.26100.1591_none_d0b554d77644b199\wowreg32.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.26100.712_none_231685f601e78e59\r\SpatialAudioLicenseSrv.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eudcedit_31bf3856ad364e35_10.0.26100.1_none_60e0d7585c6b83b9\eudcedit.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.26100.1_none_f306a7a7706ba025\setup16.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\DataSvcUtil.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..dialoghost.appxmain_31bf3856ad364e35_10.0.26100.1150_none_ab86ca35f5ea21f3\CredDialogHost.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.26100.1150_none_8e0a1d6fce8b1d12\r\adamsync.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.26100.1591_none_41b5bdf47d61c05c\SecurityHealthHost.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.26100.1591_none_70d0fee4fcc0ae07\r\sdbinst.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\SyncAppvPublishingServer.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.26100.1591_none_069d7eb507aa0068\SearchIndexer.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.26100.1742_none_54e0c846cffbbd55\r\LaunchTM.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-i..atedusermode-kernel_31bf3856ad364e35_10.0.26100.1742_none_83617bab44bfd415\r\securekernel.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\r\NETSTAT.EXE- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SystemApps\Microsoft.Windows.FileExplorer_cw5n1h2txyewy\FileExplorer.exe 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.26100.1_none_87331ff41de2f505\schtasks.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.26100.1591_none_09f5b9f9e6fe0f73\r\hvsiproxyapp.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.26100.1_none_6bac5cbeaae00b9d\tttracer.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\EdmGen.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filepicker.appxmain_31bf3856ad364e35_10.0.26100.1591_none_5e31b7c284234e98\r\FilePicker.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_caspol_b03f5f7f11d50a3a_4.0.15912.0_none_f28dd746997c1837\CasPol.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..pertiescomputername_31bf3856ad364e35_10.0.26100.1_none_37bb8503d92b5a7e\SystemPropertiesComputerName.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tapicore_31bf3856ad364e35_10.0.26100.1_none_eb822b3ce383f6d7\dialer.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..alenrollmentmanager_31bf3856ad364e35_10.0.26100.1591_none_4177de30403bfb76\r\CredentialEnrollmentManager.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.26100.1150_none_d0d1e07b8681fa6b\r\dllhost.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deployment_31bf3856ad364e35_10.0.26100.1591_none_97aef1f19d54d967\setupugc.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ttings-removedevice_31bf3856ad364e35_10.0.26100.1150_none_4f487e99a54cb5d2\r\SystemSettingsRemoveDevice.exe- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\r\TCPSVCS.EXE- 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-09_b0425ceaa128a7c01664cd4176a3dc5e_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4332
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 4.4MB
- SHA256 93617741110ed11530cfdef08c562bfec043bb4009b11a9e4ec64d101220363d
- MD5 2116fdacb33784a0e842e23129d4840b
- SHA1 37b5d957791464a11c7db5f5902c372040d7aee3
- SHA512 94ded7ef36c7e152b1ad6746375df08666b5e372e4dec10ecd9235ba85bf4cf8c7c780bf92145d707f9a46aff6979d8bf720984bcd26fca9ed292dfece13a0a6
- SSDEEP 49152:kdJDp5O+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkySpYqJPji0Ajh:kTzP0oAaldmdmnpS6Cjot
- TLSH T170266A03F56445E9C066C074CEA29666EB713C4907F1A6EF2294B6E93E33AD13F39721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\ExportLock.exe
- Size 4.2MB
- SHA256 ad06b92ba76713be82eb9ad77d4fe91b37944f90178d707cc63021202fa989e2
- MD5 a44f92a21d51c4084fbc4c97e31c5d45
- SHA1 aad5a850e635272f006462d172837708bff89758
- SHA512 c0fb131957d58829a92da3a3aca04e72a4c1df2276a4448b7fc1674a552a4ee62388acf7a8e3f235ede9b18d8dc835622510daf778963f4c6335f84ef606371e
- SSDEEP 49152:kdJDp5O+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkySpYq8UyvggFj8Z1:kTzP0oAaldmdmnpS6BbFj8Z1
- TLSH T1AC266A03A65409E9D056C074CE628622EB713C4D47F1A6EF3294BAEA3E77AD03F39751
- MD5 SHA1 SHA512 SSDEEP TLSH