5bd293ec13890f05366ff954ca4fcba33d257e70faedc2aae384365e94b672c9

Analysis

max time kernel
15s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 22:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-09_dba77be7edfbad56ddd590843628ff93_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
Size 8.5MB
Sample260910-2pshyseh99
SHA256 5bd293ec13890f05366ff954ca4fcba33d257e70faedc2aae384365e94b672c9
MD5 dba77be7edfbad56ddd590843628ff93
SHA1 0cd55166ca27fe540114c06eca9718ad519515f8
SHA512 8bb8205b9de14ca01efcd9e4b7d733668c2416e8c624e2224b56dc75dec9a0712f012cb1503dc34605900a9328f22412f493c5229bb0fdb0f0937c7392aed1ba
SSDEEP 98304:wKUgTH2M2m9UMpu1QfLczqssnKSFui+w32+QDENms2d:ggTH2qBpu1QfLIqsufFui+LjENA
TLSH
T10B96172162DA9FACC05FA430CE4A75A566237C458F61AFDF19807E293E756B05F3820F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence

Malware Config

Signatures

Detects executables packed with ASPack 8 IoCs

resource	yara_rule
behavioral2/memory/2608-0-0x0000000000400000-0x0000000000417000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c577-8.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2608-11-0x0000000000400000-0x0000000000417000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3180-18-0x0000000000400000-0x0000000000417000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c579-20.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5184-22-0x0000000000400000-0x0000000000417000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4236-23-0x0000000000400000-0x0000000000417000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3188-24-0x0000000000400000-0x0000000000417000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 5 IoCs

pid	Process
3188	MSWDM.EXE
5184	MSWDM.EXE
4160	2026-09-09_DBA77BE7EDFBAD56DDD590843628FF93_AKIRA_AMADEY_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_NJRAT_REMCOS_VIDAR_WANNACRY.EXE
3180	MSWDM.EXE
4236	MSWDM.EXE

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	2026-09-09_dba77be7edfbad56ddd590843628ff93_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	2026-09-09_dba77be7edfbad56ddd590843628ff93_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\MSWDM.EXE	2026-09-09_dba77be7edfbad56ddd590843628ff93_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Windows\dev3F13.tmp	2026-09-09_dba77be7edfbad56ddd590843628ff93_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Windows\dev3F13.tmp	MSWDM.EXE

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-09_DBA77BE7EDFBAD56DDD590843628FF93_AKIRA_AMADEY_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_NJRAT_REMCOS_VIDAR_WANNACRY.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-09_dba77be7edfbad56ddd590843628ff93_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5184	MSWDM.EXE
5184	MSWDM.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 3188	2608	2026-09-09_dba77be7edfbad56ddd590843628ff93_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe	89
PID 2608 wrote to memory of 5184	2608	2026-09-09_dba77be7edfbad56ddd590843628ff93_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe	90
PID 5184 wrote to memory of 4160	5184	MSWDM.EXE	92
PID 5184 wrote to memory of 3180	5184	MSWDM.EXE	93

C:\Users\Admin\AppData\Local\Temp\2026-09-09_dba77be7edfbad56ddd590843628ff93_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-09_dba77be7edfbad56ddd590843628ff93_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2608
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3188
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\dev3F13.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-09_dba77be7edfbad56ddd590843628ff93_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe! !
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5184
- - C:\Users\Admin\AppData\Local\Temp\2026-09-09_DBA77BE7EDFBAD56DDD590843628FF93_AKIRA_AMADEY_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_NJRAT_REMCOS_VIDAR_WANNACRY.EXE
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4160
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\dev3F13.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-09_DBA77BE7EDFBAD56DDD590843628FF93_AKIRA_AMADEY_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_NJRAT_REMCOS_VIDAR_WANNACRY.EXE!
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:3180

C:\Windows\MSWDM.EXE
MSWDM.EXE
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-09-09_DBA77BE7EDFBAD56DDD590843628FF93_AKIRA_AMADEY_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_NJRAT_REMCOS_VIDAR_WANNACRY.EXE

Path C:\Users\Admin\AppData\Local\Temp\2026-09-09_DBA77BE7EDFBAD56DDD590843628FF93_AKIRA_AMADEY_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_NJRAT_REMCOS_VIDAR_WANNACRY.EXE
Size 8.5MB
SHA256 d3499e13e74de66ece72c66a458ceee68a9f4e725049b5474c847481663a78be
MD5 0d53b0087146477e225c092964bd6310
SHA1 88f60e733707e370a9ca7271a54a091e6241af5f
SHA512 ff5143bba193f5c01da9da4fdf3bd476079482983a439dad3b142355f185f1ec32657c50337e85ace8359cfe51b273ed535b94bd0a250ca95f671db141f0bc92
SSDEEP 98304:wKUgTH2M2m9UMpu1QfLczqssnKSFui+w32+QDENms23:ggTH2qBpu1QfLIqsufFui+LjEN+
TLSH
T1F196172162DA9FACC05FA430CE4A75A566237C458F61AFDF19807E293E756B05F3820F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-09-09_dba77be7edfbad56ddd590843628ff93_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-09-09_dba77be7edfbad56ddd590843628ff93_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
Size 8.5MB
SHA256 0cdfee72484155a0c822b587ec99b669bd37dacc71ffba95806e184b934931f1
MD5 524842eaa04922af1914bf73f56ce434
SHA1 1492896a75bbadce8e33cddea418ef36beabfca5
SHA512 b9f9647c01a7b5efa71e3aef90e1558e22308762932b9a7bd9d8e5ec4954750feabc6a255c8e1595e94fa5cf8269922308eccfc80a3fecc395f35c1b50fd98be
SSDEEP 98304:DTH2M2m9UMpu1QfLczqssnKSFui+w32+QDENms23:DTH2qBpu1QfLIqsufFui+LjEN+
TLSH
T15996282122D99FE9C05FA130CE4A76B46633BC418F619FDF19447E2A3E752A05E3921F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSWDM.EXE

Path C:\Windows\MSWDM.EXE
Size 5.7MB
SHA256 e275307e1b88f1f8a1aac148f2c5c26dc3037f22fff3f4e60762342956cd159c
MD5 e1695ce3a4297a547260d97f3294f200
SHA1 f4bf3bc16fd687272928e8aa8afed0b5d8ad336d
SHA512 d88b2ab36247bdf86130a79808a34e5d12cd9daca41a948d5535dbdd35e1f869bd32e5870eb74c68b04b4eb5b5fb5d631e3af754ffa4fc045e7394dd31ab14af
SSDEEP 49152:OPv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPB7:wKUgTH2M2m9UMpu1QfLczqssnKS6
TLSH
T17456B41165DA9FDCC05FA474CE0669A16A237C868F61AFDF0980BE253E756B06F3810F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dev3F13.tmp

Path C:\Windows\dev3F13.tmp
Size 2.7MB
SHA256 20b1b637692a87fd194d457ec0ffe33c351363600c926c9ebd2455ad98a566c9
MD5 ce9bb918cf467639704c6c1352006ab0
SHA1 0031fc5e096629078a2bcfeeae2ee6dcb7e64f82
SHA512 c8500870c0318e00bc68ac97adbf318310e61d8f6135a97e52075d8c0b04c86a133ab076c740364191d432e1aba5588df59202abeec0527ad8e30f40750ad38a
SSDEEP 49152:l3BKBUvdWJTy4uia5w32OvfZcvkuRdLHkJEANmsvHHu34:Iui+w32+QDENms2I
TLSH
T18FD5AE2173D4D137D092A330CFEDB27877BBBA108566D31B251D2A6A78B13904F5A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2608-0-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/2608-11-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/3180-18-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/3188-24-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/4236-23-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/5184-22-0x0000000000400000-0x0000000000417000-memory.dmp

Download