77951d3b60816db6bfdfb3da84ea120df4e47933ae16d6fbf775d479646eb54c

Analysis

max time kernel
15s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 11:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_bc45df950d00f3525a38a2d3ce94c5d5_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
Size 10.2MB
Sample260910-nhfc6awsdy
SHA256 77951d3b60816db6bfdfb3da84ea120df4e47933ae16d6fbf775d479646eb54c
MD5 bc45df950d00f3525a38a2d3ce94c5d5
SHA1 4b44adf9f6c5355152a2f6ed77731b274953b869
SHA512 e3a9a7b972283a0e18ea547e8ac159d73215e1c6e915b4c7c71d3fe6636cbc7813be232efad71c729d196914da0c96a0370831f48248daf7d335b998f6596249
SSDEEP 98304:5NUgTH2M2m9UMpu1QfLczqssnKSYtAfkZccui+w32+QDENms2p:5+gTH2qBpu1QfLIqsufYAPcui+LjEN0
TLSH
T186B6391172E98FA9C06FD034CE4676A5AA337C418F219FDB09447E293E766E05E3921F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence

Malware Config

Signatures

Custom signature

Detects executables packed with ASPack 8 IoCs

resource	yara_rule
behavioral2/memory/1492-0-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x001500000001c4de-4.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1492-12-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2448-18-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c587-20.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/6112-22-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/6124-24-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3080-25-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x001500000001c4de-4.dat	aspack_v212_v242
behavioral2/files/0x000d00000001c587-20.dat	aspack_v212_v242

Executes dropped EXE 5 IoCs

pid	Process
3080	MSWDM.EXE
6112	MSWDM.EXE
1004	2026-09-10_BC45DF950D00F3525A38A2D3CE94C5D5_AKIRA_AMADEY_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_NJRAT_REMCOS_VIDAR.EXE
2448	MSWDM.EXE
6124	MSWDM.EXE

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	2026-09-10_bc45df950d00f3525a38a2d3ce94c5d5_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	2026-09-10_bc45df950d00f3525a38a2d3ce94c5d5_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\dev58A5.tmp	MSWDM.EXE
File created	C:\WINDOWS\MSWDM.EXE	2026-09-10_bc45df950d00f3525a38a2d3ce94c5d5_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\dev58A5.tmp	2026-09-10_bc45df950d00f3525a38a2d3ce94c5d5_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_BC45DF950D00F3525A38A2D3CE94C5D5_AKIRA_AMADEY_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_NJRAT_REMCOS_VIDAR.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_bc45df950d00f3525a38a2d3ce94c5d5_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6112	MSWDM.EXE
6112	MSWDM.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 3080	1492	2026-09-10_bc45df950d00f3525a38a2d3ce94c5d5_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe	89
PID 1492 wrote to memory of 6112	1492	2026-09-10_bc45df950d00f3525a38a2d3ce94c5d5_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe	90
PID 6112 wrote to memory of 1004	6112	MSWDM.EXE	92
PID 6112 wrote to memory of 2448	6112	MSWDM.EXE	93

C:\Users\Admin\AppData\Local\Temp\2026-09-10_bc45df950d00f3525a38a2d3ce94c5d5_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_bc45df950d00f3525a38a2d3ce94c5d5_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1492
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3080
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\dev58A5.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-10_bc45df950d00f3525a38a2d3ce94c5d5_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe! !
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:6112
- - C:\Users\Admin\AppData\Local\Temp\2026-09-10_BC45DF950D00F3525A38A2D3CE94C5D5_AKIRA_AMADEY_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_NJRAT_REMCOS_VIDAR.EXE
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1004
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\dev58A5.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-10_BC45DF950D00F3525A38A2D3CE94C5D5_AKIRA_AMADEY_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_NJRAT_REMCOS_VIDAR.EXE!
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2448

C:\Windows\MSWDM.EXE
MSWDM.EXE
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:6124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-09-10_BC45DF950D00F3525A38A2D3CE94C5D5_AKIRA_AMADEY_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_NJRAT_REMCOS_VIDAR.EXE

Path C:\Users\Admin\AppData\Local\Temp\2026-09-10_BC45DF950D00F3525A38A2D3CE94C5D5_AKIRA_AMADEY_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_NJRAT_REMCOS_VIDAR.EXE
Size 10.2MB
SHA256 10102f0ec852eb2ad3711395b991330d5052d6da873ddc17cf0de486473d290e
MD5 dae8ef63859f1772b56483eeb272569c
SHA1 29a0a9dc208efd8d2dea6fbee3d1d84a15dfbede
SHA512 e9fb269b1b3aa613ab42b8ff539d596a488292aed625782de5d56970e6506a564e351eb4dd7900f9903e976a9eabefc31c10a69ad9e8b7b85dfa2af8f0264075
SSDEEP 98304:5NUgTH2M2m9UMpu1QfLczqssnKSYtAfkZccui+w32+QDENms2D:5+gTH2qBpu1QfLIqsufYAPcui+LjENi
TLSH
T176B6391172E98FA9C06FD034CE4676A5AA337C418F219FDB09447E293E766E05E3921F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-09-10_bc45df950d00f3525a38a2d3ce94c5d5_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-09-10_bc45df950d00f3525a38a2d3ce94c5d5_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
Size 10.2MB
SHA256 1da114c73ed9e1dc42a17755d5aabfa2fc06e505484628c8e453d64061e23e5b
MD5 e777327191783725b25883f472bcab01
SHA1 f58c691046c51503ef3bc0738bd19c659ed51e11
SHA512 422a7110ac0a9a4341f85227077394e732f48212c6cb37b69da079dae6fe25ee331c8727d72d37280844515c13d0a0d6290ecf0cdd938817eb30a18a70244b8f
SSDEEP 98304:IuiMM2m9UMpu1QfLczqssnKSYtAfkZccui+w32+QDENms2D:IuiMqBpu1QfLIqsufYAPcui+LjENi
TLSH
T143B64B2172E9CFA5C06F9130CD9676A4A6737C418F219FCB19447E2D3E762A09E3522F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSWDM.EXE

Path C:\Windows\MSWDM.EXE
Size 7.5MB
SHA256 6c8424ea3014a181cfdfea994d69f4329cace94b630d90937d3f7b14b27a0333
MD5 2ffb8c52cc71d14655cf4db29bbf829c
SHA1 b1f2ff3c4ded458a3c55ec01a10f5bfedddca25c
SHA512 2350efc73f9b11a42115f9cfc503079b1e942a6781946bee96847fa55c8744fae8ad5911ec0208851c14c7733e9c49bfd7e5d5cc238bfcd09ad18270becd6289
SSDEEP 98304:5NUgTH2M2m9UMpu1QfLczqssnKSYtAfkZcD:5+gTH2qBpu1QfLIqsufYAPD
TLSH
T1C276E71161E98FDCC06FD474CE466AA5AA237C458F209FDF0981BE293E766E05E3421F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dev58A5.tmp

Path C:\Windows\dev58A5.tmp
Size 2.7MB
SHA256 20b1b637692a87fd194d457ec0ffe33c351363600c926c9ebd2455ad98a566c9
MD5 ce9bb918cf467639704c6c1352006ab0
SHA1 0031fc5e096629078a2bcfeeae2ee6dcb7e64f82
SHA512 c8500870c0318e00bc68ac97adbf318310e61d8f6135a97e52075d8c0b04c86a133ab076c740364191d432e1aba5588df59202abeec0527ad8e30f40750ad38a
SSDEEP 49152:l3BKBUvdWJTy4uia5w32OvfZcvkuRdLHkJEANmsvHHu34:Iui+w32+QDENms2I
TLSH
T18FD5AE2173D4D137D092A330CFEDB27877BBBA108566D31B251D2A6A78B13904F5A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1492-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1492-12-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2448-18-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3080-25-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/6112-22-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/6124-24-0x0000000000400000-0x0000000000414000-memory.dmp

Download