40d06c78da1d6d0400aef65cc70e8503d546dcf9d99e8ed668dd7b9ef91cdd56

Analysis

max time kernel
15s
max time network
3s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 16:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_5e4a3d936c4c6debac011c77520367a1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_ipam.exe
Size 7.1MB
Sample260910-twmbhssdld
SHA256 40d06c78da1d6d0400aef65cc70e8503d546dcf9d99e8ed668dd7b9ef91cdd56
MD5 5e4a3d936c4c6debac011c77520367a1
SHA1 a3d1c786d0e409d51cfefe761c7df89d8ea12c44
SHA512 21591634f2a8be65bf83abd338cbe03ae95f3d21b2cf6a69f7b9fb233d22dc95d48419c5b3c71acfb58824c6bd9398585215bd52b5f8e1ca930a6ba4865ece58
SSDEEP 98304:ktLUgTH2M2m9UMpu1QfLczqssnKS66OfkZcJrtr:9gTH2qBpu1QfLIqsuf6pPFR
TLSH
T17176E71161E98FDDC05FD474CE4669A5AA237C468F209FDF0980BE293E766B05E3821F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence

Malware Config

Signatures

Detects executables packed with ASPack 8 IoCs

resource	yara_rule
behavioral2/memory/3672-0-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c485-9.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3672-11-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4132-17-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c487-19.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4976-20-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1016-18-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2604-21-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 5 IoCs

pid	Process
2604	MSWDM.EXE
4976	MSWDM.EXE
5632	2026-09-10_5E4A3D936C4C6DEBAC011C77520367A1_AKIRA_AMADEY_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_IPAM.EXE
4132	MSWDM.EXE
1016	MSWDM.EXE

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	2026-09-10_5e4a3d936c4c6debac011c77520367a1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_ipam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	2026-09-10_5e4a3d936c4c6debac011c77520367a1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_ipam.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\devFC5C.tmp	2026-09-10_5e4a3d936c4c6debac011c77520367a1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_ipam.exe
File opened for modification	C:\Windows\devFC5C.tmp	MSWDM.EXE
File created	C:\WINDOWS\MSWDM.EXE	2026-09-10_5e4a3d936c4c6debac011c77520367a1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_ipam.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_5e4a3d936c4c6debac011c77520367a1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_ipam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4976	MSWDM.EXE
4976	MSWDM.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3672 wrote to memory of 2604	3672	2026-09-10_5e4a3d936c4c6debac011c77520367a1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_ipam.exe	89
PID 3672 wrote to memory of 4976	3672	2026-09-10_5e4a3d936c4c6debac011c77520367a1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_ipam.exe	90
PID 4976 wrote to memory of 5632	4976	MSWDM.EXE	92
PID 4976 wrote to memory of 4132	4976	MSWDM.EXE	93

C:\Users\Admin\AppData\Local\Temp\2026-09-10_5e4a3d936c4c6debac011c77520367a1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_ipam.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_5e4a3d936c4c6debac011c77520367a1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_ipam.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3672
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2604
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\devFC5C.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-10_5e4a3d936c4c6debac011c77520367a1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_ipam.exe! !
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\Users\Admin\AppData\Local\Temp\2026-09-10_5E4A3D936C4C6DEBAC011C77520367A1_AKIRA_AMADEY_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_IPAM.EXE
    3⤵
    - Executes dropped EXE
    PID:5632
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\devFC5C.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-10_5E4A3D936C4C6DEBAC011C77520367A1_AKIRA_AMADEY_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_IPAM.EXE!
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4132

C:\Windows\MSWDM.EXE
MSWDM.EXE
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-09-10_5E4A3D936C4C6DEBAC011C77520367A1_AKIRA_AMADEY_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_IPAM.EXE

Path C:\Users\Admin\AppData\Local\Temp\2026-09-10_5E4A3D936C4C6DEBAC011C77520367A1_AKIRA_AMADEY_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_IPAM.EXE
Size 7.1MB
SHA256 c445e60a5e422cee9b48f78b6332663660d64adf5e663a4337aae31243ba4858
MD5 ea3c867f2b9f871a597ce87ca00f5d8a
SHA1 56fb8d71d12dcc75a91fd27b59b173e69c09899e
SHA512 cade5a92e580ee809decc0a70dc6c9a1911e8236903ba82c8d137fafa91ec6ad80831d1ed0834733b25652e1dd38a9127d0af254fe0a59373cc163d5ae5bc7ac
SSDEEP 98304:ktLUgTH2M2m9UMpu1QfLczqssnKS66OfkZcJrt9:9gTH2qBpu1QfLIqsuf6pPFX
TLSH
T1C976E71161E98FDDC05FD474CE4669A5AA237C468F209FDF0980BE293E766B05E3821F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSWDM.EXE

Path C:\WINDOWS\MSWDM.EXE
Size 6.9MB
SHA256 0d719959cda6c7ebba6e060ea8555cf1805aa25f8d927b0f14dac2a71c41edcc
MD5 33a69b0f44ad075e83a39dff9373bd10
SHA1 07398dc9bb7e4523a042334b5ab3f24fab508174
SHA512 ab4ed6ec02b39f049bc78a1ed45c80aa8a11da66e20b28031564cab90d99fc5e871e543358c1b0159d312616956b8f147e457fd9960bc3c6ca520cc47f088085
SSDEEP 98304:ktLUgTH2M2m9UMpu1QfLczqssnKS66OfkZcD:9gTH2qBpu1QfLIqsuf6pPD
TLSH
T14476E71165E98FDCC05FD474CE4669A5AA237C468F209FDF0980BE293E766B06E3421F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

devFC5C.tmp

Path C:\Windows\devFC5C.tmp
Size 248KB
SHA256 471c556cf9405bbb380a8cefe945c126b954b7c94f79cc72441b51f80141fc5e
MD5 5b6e8e09be6401a7e022f52fdfcb2ff8
SHA1 f41e2888787f764d48c7eeef09f3f047a9f3c352
SHA512 b1e2e2c9205ebd7b907e30b2452bfcaf4922d4df16aefcdc54bce856c1dbd552057ac1eeb014b70efc5c60bc2b3fd3785a08bc0cac4f6ebfc066629fde5ff138
SSDEEP 6144:/p9Fhh2oXaqARzuE7ko1rWpU3rqjgEFj1F0xEtF:/Nhh9Xaqsyyko1rWaqjDKqtF
TLSH
T1C9449E2276A0C433D26310748EB5C7B25FBEFD721972A447A7D40E6EAE742D1DA38316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1016-18-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2604-21-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3672-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3672-11-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4132-17-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4976-20-0x0000000000400000-0x0000000000414000-memory.dmp

Download