Analysis
- max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/11/2026, 11:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 3.8MB
- Sample261110-nzyaasat21
- SHA256 0cf23e0c725ab50ae3da594e949c7064f4fb022b271beb966a33c0df6679a3e0
- MD5 a7bfe8d09d7f6572d3f5d1fcc7280f21
- SHA1 0945a1a6add6005635e999aac6e038e925521fab
- SHA512 217932d5a9bfac1d3c4f1bcf5ecd10546ffc5bbcef84e2024e54d4a1279155fe2cf312bba296676fb25ac98f087a0c69d2ceffa41852eec894a425d4868aedb6
- SSDEEP 49152:kdJDp5O+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyNVBXdc8:kTzP0oAaldmdmnphdD
- TLSH T1C5065A03A69508E9D15AC134DE628532EB617C4D47F1A6EF3294BAE63E33AD03F39711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\CloudNotifications.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\Com\comrepl.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\print.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\dialer.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\charmap.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\label.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\perfhost.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\svchost.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\autofmt.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\compact.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\DpiScaling.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\iexpress.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\isoburn.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\PresentationHost.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\regedit.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\subst.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\mobsync.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\timeout.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\userinit.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\where.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\diskperf.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\eventcreate.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\RmClient.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\setupugc.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\setx.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\fsutil.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\mtstocom.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\RMActivate.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\doskey.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\label.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\wecutil.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\regedit.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\mcbuilder.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\msfeedssync.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\RdpSa.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\sxstrace.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\clip.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\PickerHost.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\SearchIndexer.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\tzutil.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\unregmp2.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\DpiScaling.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\msdt.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\Robocopy.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\instnm.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\isoburn.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Media Player\setup_wm.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Mail\wabmig.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\7-Zip\7z.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Internet Explorer\ielowutil.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\ShowConnect.bat- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\show_third_party_software_licenses.bat 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\OOBENetworkConnectionFlow.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-convert_31bf3856ad364e35_10.0.19041.1266_none_119b1e415d838a28\f\autoconv.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-bash_31bf3856ad364e35_10.0.19041.1151_none_b46b739f71bbb8b7\r\bash.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-service_31bf3856ad364e35_10.0.19041.1_none_1a96c19044750bbf\BdeUISrv.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shutdown-event-tracker_31bf3856ad364e35_10.0.19041.1_none_b8c5253467557e69\shutdown.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.19041.173_none_38fc88f8cb913df1\f\winload.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventcollector_31bf3856ad364e35_10.0.19041.662_none_d8ed4acdd3960fad\wecutil.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.19041.1_none_61cd745a990bcfb3\msinfo32.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_3f1cc1d15da468cf\f\tracerpt.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.19041.746_none_726cc4a1ebcb1c1e\r\wlrmdr.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.19041.1202_none_574a25a5ee347454\memtest.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ountcontrolsettings_31bf3856ad364e35_10.0.19041.423_none_61b0f600375d52e3\UserAccountControlSettings.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-upfc_31bf3856ad364e35_10.0.19041.1_none_5d169326bbc0abdb\upfc.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.19041.1_none_3d62a57d3b12dcf1\doskey.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_f68db62a3702882b\f\SearchFilterHost.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ldifde_31bf3856ad364e35_10.0.19041.1_none_7ab9b2c3efd290ff\ldifde.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.19041.1_none_76c543231c2d8e03\wevtutil.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_ef0e010d1381269b\iisreset.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.19041.1266_none_3bcd0306a19592e2\f\Robocopy.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.19041.746_none_726cc4a1ebcb1c1e\mpnotify.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.19041.1266_none_ccf6cb6d0aa9a822\mstsc.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-xwizard-host-process_31bf3856ad364e35_10.0.19041.1_none_1939c8a90c4232f6\xwizard.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ComSvcConfig.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-trustedinstaller_31bf3856ad364e35_10.0.19041.153_none_6ef8a222ac00dbc2\r\TrustedInstaller.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.19041.746_none_be98bb8265bc211a\mmgaserver.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.19041.1237_none_556ba5d1df8130ac\f\printui.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..nfiguration-cmdline_31bf3856ad364e35_10.0.19041.1_none_c9a1700d547d6cde\powercfg.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SystemApps\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\CapturePicker.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1202_none_23a707c9a0b5a8e1\Taskmgr.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.84_none_b4499a04dddcc22e\ssh-keygen.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.19041.572_none_4d40b8e902f83dd6\f\gpscript.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-autochk_31bf3856ad364e35_10.0.19041.1266_none_610e6b21ab533b13\autochk.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.19041.264_none_e6d5f08988c6cb95\DWWIN.EXE- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\r\MicrosoftEdge.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_10.0.19041.1110_none_4f46693352ed3250\f\msconfig.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regsql.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.19041.928_none_b321f2c2ab7710a2\r\sdbinst.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..tegrity-diagnostics_31bf3856ad364e35_10.0.19041.985_none_4a26c2c5164ad5c7\r\CIDiag.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..rvices-adam-install_31bf3856ad364e35_10.0.19041.1_none_d2c567b17279a950\adaminstall.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..lity-eoaexperiences_31bf3856ad364e35_10.0.19041.746_none_c291aefd01a5d6d6\f\EoAExperiences.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.19041.1081_none_e836fc4ed2e2ecc1\r\SpeechModelDownload.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\Temp\PendingDeletes\a30f994536e5d701169b00001815341f.aspnetca.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.1266_none_8a8440f738abd1b9\f\wmpshare.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..mnotificationbroker_31bf3856ad364e35_10.0.19041.746_none_a5ade2e84580e250\r\DmNotificationBroker.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.19041.746_none_7c508e4438cec899\r\LicensingUI.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.264_none_583d67d6d00b6b6a\WerFault.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.19041.746_none_56f2f7338735a9a6\r\WFS.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-label_31bf3856ad364e35_10.0.19041.1_none_0d20194b69a60627\label.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vssadmin_31bf3856ad364e35_10.0.19041.1_none_7a6e62f3d1012ed4\vssadmin.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.1081_none_ef39acce2648e404\WerFaultSecure.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-gdi_31bf3856ad364e35_10.0.19041.264_none_920963acedc8777d\f\fontdrvhost.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.19041.1_none_b84e385529c68af9\unlodctr.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\x86_msbuild_b03f5f7f11d50a3a_10.0.19041.1_none_421bb61742382b2d\MSBuild.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.264_none_1477a882bdce0df2\f\vmms.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_10.0.19041.153_none_b4f0bd83cfc7701e\r\AxInstUI.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-csrss_31bf3856ad364e35_10.0.19041.546_none_36dd2ad842e4f8c3\f\csrss.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.19041.1_none_f58a3da76ed0f251\dsdbutil.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-web-app-host_31bf3856ad364e35_10.0.19041.789_none_1060d2d22df7c6eb\f\WWAHost.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..tx-dxgiadaptercache_31bf3856ad364e35_10.0.19041.84_none_9f3e49455f52d8f7\f\dxgiadaptercache.exe- 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-09_a7bfe8d09d7f6572d3f5d1fcc7280f21_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2660
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 4.3MB
- SHA256 841d25a06a53edd4f3c896a6d9095c2f00fedd4e53078fe1ce38847feca32c2c
- MD5 77ca3873e80405c3e9a8aee17272a019
- SHA1 cf6947e83e0648457fb901090a11bde03ddc5bd8
- SHA512 1cace85023a9c3f2389543a90cdb90ffa74736ff79dca306c1ac97387c9d77ba1a636165663627d6adf537dd254c21ebc6e90683e5e6dd7fe2b30c4ec81013ae
- SSDEEP 49152:kdJDp5O+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyNVBXdcGPji0AjT:kTzP0oAaldmdmnphd7joH
- TLSH T1A2266B03B65405E9D066C078CE628626EB713C4947F1A6EF3294BAE93E37AD13F39711
- MD5 SHA1 SHA512 SSDEEP TLSH