e39f714b96a9bb52013e465c380fc5843734e1dc182448f4fd23fa69b0f8ad9b

Analysis

max time kernel
15s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 14:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_7ef1e5520fa78e007c06261109c15457_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe
Size 6.7MB
Sample260910-r6hd7shd44
SHA256 e39f714b96a9bb52013e465c380fc5843734e1dc182448f4fd23fa69b0f8ad9b
MD5 7ef1e5520fa78e007c06261109c15457
SHA1 28f737c1584e22cf7d0c397a3dd5eda8e178f101
SHA512 4f84d71387a4ac17169160fe9081e5e4c7ad8752b53ab5a2bd015a207c2c21928db55a29ce02861afb90776311b744cefad1771541fc916181edb053dacc2607
SSDEEP 98304:5aUgTH2M2m9UMpu1QfLczqssnKSv6ps+wE9XD8VBu:5FgTH2qBpu1QfLIqsufvuV9z8G
TLSH
T14E66E61162DA9FDCC05FA474CE0665B16A237C468F61AFDF19807E293E756B06E3820F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence

Malware Config

Signatures

Detects executables packed with ASPack 8 IoCs

resource	yara_rule
behavioral2/memory/3040-0-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c6dd-4.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3040-12-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4716-22-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000b00000001c6df-23.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2344-26-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3684-25-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/956-27-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c6dd-4.dat	aspack_v212_v242
behavioral2/files/0x000b00000001c6df-23.dat	aspack_v212_v242

Executes dropped EXE 5 IoCs

pid	Process
956	MSWDM.EXE
3684	MSWDM.EXE
1836	2026-09-10_7EF1E5520FA78E007C06261109C15457_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_LUCA-STEALE.EXE
4716	MSWDM.EXE
2344	MSWDM.EXE

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	2026-09-10_7ef1e5520fa78e007c06261109c15457_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	2026-09-10_7ef1e5520fa78e007c06261109c15457_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\MSWDM.EXE	2026-09-10_7ef1e5520fa78e007c06261109c15457_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe
File opened for modification	C:\Windows\dev529B.tmp	2026-09-10_7ef1e5520fa78e007c06261109c15457_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe
File opened for modification	C:\Windows\dev529B.tmp	MSWDM.EXE

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_7EF1E5520FA78E007C06261109C15457_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_LUCA-STEALE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_7ef1e5520fa78e007c06261109c15457_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3684	MSWDM.EXE
3684	MSWDM.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 956	3040	2026-09-10_7ef1e5520fa78e007c06261109c15457_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe	89
PID 3040 wrote to memory of 3684	3040	2026-09-10_7ef1e5520fa78e007c06261109c15457_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe	90
PID 3684 wrote to memory of 1836	3684	MSWDM.EXE	91
PID 3684 wrote to memory of 4716	3684	MSWDM.EXE	93

C:\Users\Admin\AppData\Local\Temp\2026-09-10_7ef1e5520fa78e007c06261109c15457_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_7ef1e5520fa78e007c06261109c15457_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3040
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:956
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\dev529B.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-10_7ef1e5520fa78e007c06261109c15457_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe! !
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3684
- - C:\Users\Admin\AppData\Local\Temp\2026-09-10_7EF1E5520FA78E007C06261109C15457_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_LUCA-STEALE.EXE
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1836
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\dev529B.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-10_7EF1E5520FA78E007C06261109C15457_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_LUCA-STEALE.EXE!
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4716

C:\Windows\MSWDM.EXE
MSWDM.EXE
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-09-10_7EF1E5520FA78E007C06261109C15457_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_LUCA-STEALE.EXE

Path C:\Users\Admin\AppData\Local\Temp\2026-09-10_7EF1E5520FA78E007C06261109C15457_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_LUCA-STEALE.EXE
Size 6.7MB
SHA256 7fbd88a63ecbdd2ce0e4d8f54902aa3aaa6ea14e66b60830c4ed74d907016ca9
MD5 690bd7a590aef72c35eb48c36b5f94f9
SHA1 d7a70a6d339cf6c1cd06b3df1159d361f25d2c25
SHA512 12d6706f205b406d9d16bd062db1774be7ed1c16690fa5f744933e8a4f994f46a9728cd5c46393342dae499ebcf8e064bde148274aef7edb604e72bc2300aab5
SSDEEP 98304:5aUgTH2M2m9UMpu1QfLczqssnKSv6ps+wE9XD8VBj:5FgTH2qBpu1QfLIqsufvuV9z8r
TLSH
T17066E61162DA9FDCC05FA474CE0665B16A237C468F61AFDF19807E293E756B06E3820F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-09-10_7ef1e5520fa78e007c06261109c15457_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-09-10_7ef1e5520fa78e007c06261109c15457_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe
Size 6.7MB
SHA256 24e267b51220d1ae954018a40310743f1bf1c282505cdeac9f27d6ec64560aba
MD5 d6aea430a98aeff3e21968eadbc09b9b
SHA1 fad6f449455bb15e6780ad82a0d9f37b419c42e9
SHA512 87263ff11c23f9d9b44bff60f9ae1bf6c93dd9a18ed791ed4bf633c2821ac2fe5e6e1f81c094895c731a9582a8a7cf96ed626c14e20a9a472268c98654e541a6
SSDEEP 98304:4s+wE9XDtgTH2M2m9UMpu1QfLczqssnKSv6ps+wE9XD8VBj:4V9ztgTH2qBpu1QfLIqsufvuV9z8r
TLSH
T11A66072166DA9FECC15FA430CE0675A166237C558F21AFDF19807E293E752B06E3821F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSWDM.EXE

Path C:\Windows\MSWDM.EXE
Size 5.9MB
SHA256 0df2a34e5ee3682b50d6caa42edca5745e47c17018bc75eb444cbd5ac2e5846b
MD5 352ba29c05fabaa929dffb7e5b9e032a
SHA1 a4c62a8f7e5b2df134eabc4058c526886da1af04
SHA512 b71ab6788ffb532167c6542a2e0b88cc5ccd89e29e0db6e6e310c64163c78328d56e03ccd6bead887035a4c73b3a84c0d2338fd0790a1d5a60f18dfb5ae3bc79
SSDEEP 49152:5aU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPBq/UybpuO:5aUgTH2M2m9UMpu1QfLczqssnKSv6M
TLSH
T16056C41162DA9FDCC05FA474CE0669B16A237C468F61AFDF19807E293E756B06E3810F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dev529B.tmp

Path C:\Windows\dev529B.tmp
Size 794KB
SHA256 2435e1e50c097608e6157efb1036946cfdd02d86728e8e00a02b207bee36e60d
MD5 c6d0721e9156eb2a40a04bb38be0b2a5
SHA1 d0a3fcb3ad9f227a02d30abb767883b42fecc3a7
SHA512 e254db10a7cffc4fe8c2d126dc4eb5029a84b2a931a67ad9ebfd04a8f3417e42a7dfb2e76d8911b2540bcf9eff9cbf92708b158dd8f53dbcbe7be51682ac3ad4
SSDEEP 24576:F3LutmkEz+PAVV/OOInO4Xs2ztR4iegxLHgZpJE4VDd+:FbutmkO+wAOInO4XrztygxLHkJE4VB
TLSH
T1A505D022F3D0A536D7631331993A7231BBBE66301A128B136B541F957FA61E16F2C363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/956-27-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2344-26-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3040-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3040-12-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3684-25-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4716-22-0x0000000000400000-0x0000000000414000-memory.dmp

Download