278396d9b9dfad7cf4a92f76805a84121c9d322ac6d16516ac6d28af0b778a9a

Analysis

max time kernel
16s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 06:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_2bda1855e32f3cd4c2edef6f01e5c9f4_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
Size 8.9MB
Sample260910-hh8rtafh87
SHA256 278396d9b9dfad7cf4a92f76805a84121c9d322ac6d16516ac6d28af0b778a9a
MD5 2bda1855e32f3cd4c2edef6f01e5c9f4
SHA1 3aaddc20938f24025e24edbcdb7482baee993cf7
SHA512 22c8be3d562fdd8b1cc6a23950af05cfbbe3334ba0dd8f25882b24f387443bb1394f63ba336639612d8852277a152ae6682dcc7e8f6064b1a2ce8dc35c4597ac
SSDEEP 98304:iKUgTH2M2m9UMpu1QfLczqssnKSJd8ui+w32+QDENms2V:CgTH2qBpu1QfLIqsufJd8ui+LjENQ
TLSH
T1EC96272162D99FECC05FA034CE4A75B566237C458F21AFDF19847E293E726A05E3821F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence

Malware Config

Signatures

Detects executables packed with ASPack 8 IoCs

resource	yara_rule
behavioral2/memory/4760-0-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c539-4.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4760-12-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/6076-22-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4908-24-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c53c-19.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3096-18-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2704-25-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 5 IoCs

pid	Process
2704	MSWDM.EXE
6076	MSWDM.EXE
2096	2026-09-08_2BDA1855E32F3CD4C2EDEF6F01E5C9F4_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_NJRAT_REMCOS_VIDAR.EXE
3096	MSWDM.EXE
4908	MSWDM.EXE

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	2026-09-08_2bda1855e32f3cd4c2edef6f01e5c9f4_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	2026-09-08_2bda1855e32f3cd4c2edef6f01e5c9f4_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\MSWDM.EXE	2026-09-08_2bda1855e32f3cd4c2edef6f01e5c9f4_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\dev3406.tmp	2026-09-08_2bda1855e32f3cd4c2edef6f01e5c9f4_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\dev3406.tmp	MSWDM.EXE

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_2bda1855e32f3cd4c2edef6f01e5c9f4_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_2BDA1855E32F3CD4C2EDEF6F01E5C9F4_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_NJRAT_REMCOS_VIDAR.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6076	MSWDM.EXE
6076	MSWDM.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 2704	4760	2026-09-08_2bda1855e32f3cd4c2edef6f01e5c9f4_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe	89
PID 4760 wrote to memory of 6076	4760	2026-09-08_2bda1855e32f3cd4c2edef6f01e5c9f4_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe	90
PID 6076 wrote to memory of 2096	6076	MSWDM.EXE	91
PID 6076 wrote to memory of 3096	6076	MSWDM.EXE	93

C:\Users\Admin\AppData\Local\Temp\2026-09-08_2bda1855e32f3cd4c2edef6f01e5c9f4_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_2bda1855e32f3cd4c2edef6f01e5c9f4_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4760
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2704
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\dev3406.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-08_2bda1855e32f3cd4c2edef6f01e5c9f4_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe! !
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:6076
- - C:\Users\Admin\AppData\Local\Temp\2026-09-08_2BDA1855E32F3CD4C2EDEF6F01E5C9F4_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_NJRAT_REMCOS_VIDAR.EXE
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2096
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\dev3406.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-08_2BDA1855E32F3CD4C2EDEF6F01E5C9F4_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_NJRAT_REMCOS_VIDAR.EXE!
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:3096

C:\Windows\MSWDM.EXE
MSWDM.EXE
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-09-08_2BDA1855E32F3CD4C2EDEF6F01E5C9F4_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_NJRAT_REMCOS_VIDAR.EXE

Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_2BDA1855E32F3CD4C2EDEF6F01E5C9F4_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_NJRAT_REMCOS_VIDAR.EXE
Size 8.9MB
SHA256 a37f075f8fce76226789b4cc82f42942c2c169f7422a2eb4e1ca01fb386f388f
MD5 d61bd441ac345563e7f2e51d3b371fc9
SHA1 26e0d1ad5190b972eb68e7b740cffc4022a70715
SHA512 467125c7093547f08c9337007ab0c90b425a44492bec19999741d1cc0cb32c89b22440cbc0314728706836e0f6e3e47e70432d926acbc9f1d6687b17e5655f3b
SSDEEP 98304:iKUgTH2M2m9UMpu1QfLczqssnKSJd8ui+w32+QDENms2a:CgTH2qBpu1QfLIqsufJd8ui+LjENz
TLSH
T16C96272162D99FECC05FA034CE4A75B566237C458F21AFDF19847E293E726A05E3821F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-09-08_2bda1855e32f3cd4c2edef6f01e5c9f4_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_2bda1855e32f3cd4c2edef6f01e5c9f4_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
Size 8.9MB
SHA256 813095fe7cf3b9ebcd7c23fffd84cbe7d038412326b8017930a507a9d8fab09c
MD5 248ea6bdd798e960643169af37482a65
SHA1 4a017f84a1649a2c5065005ccd2d484341b7383d
SHA512 f63178ded391b4bcc7ec922e43cacec88025f6ae7d058bd81ea1d6417bdf3893a92ae5960c1f62222f73fecc0b7350b7eb1099d3597e5a2872f9a0243d68bed0
SSDEEP 98304:IuiM2M2m9UMpu1QfLczqssnKSJd8ui+w32+QDENms2a:IuiM2qBpu1QfLIqsufJd8ui+LjENz
TLSH
T1B596392132D9CFE9C05FA130CE5A76B46673BC018E619FDB19447E2A3E762A05E3521F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSWDM.EXE

Path C:\Windows\MSWDM.EXE
Size 6.1MB
SHA256 9587bbbe69a41201004fff8ae3c3d251267abfd312db0e08fb4471d208cb52f9
MD5 0f9c771404cc31a097cdec33b091524c
SHA1 66b6bd42d86ad7051f6f7d59d9f5d5c69d4063f9
SHA512 b3e32c7a54ab59634734e6d5b9f5c1bfc5294f40befeb877838f9bb4818f3d10f12e68bab410d5d81615227d087fee09ba6d1f7924542542dcc3eb3490c6b016
SSDEEP 49152:iKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPBq/UybpuS:iKUgTH2M2m9UMpu1QfLczqssnKSJdj
TLSH
T1DE56D61165DA9FDCC05FE474CE0669A16A237C468F61AFDF09807E293E756B06E3820F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dev3406.tmp

Path C:\Windows\dev3406.tmp
Size 2.7MB
SHA256 20b1b637692a87fd194d457ec0ffe33c351363600c926c9ebd2455ad98a566c9
MD5 ce9bb918cf467639704c6c1352006ab0
SHA1 0031fc5e096629078a2bcfeeae2ee6dcb7e64f82
SHA512 c8500870c0318e00bc68ac97adbf318310e61d8f6135a97e52075d8c0b04c86a133ab076c740364191d432e1aba5588df59202abeec0527ad8e30f40750ad38a
SSDEEP 49152:l3BKBUvdWJTy4uia5w32OvfZcvkuRdLHkJEANmsvHHu34:Iui+w32+QDENms2I
TLSH
T18FD5AE2173D4D137D092A330CFEDB27877BBBA108566D31B251D2A6A78B13904F5A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2704-25-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3096-18-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4760-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4760-12-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4908-24-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/6076-22-0x0000000000400000-0x0000000000414000-memory.dmp

Download