ab3174e8c52576099d2040beffd9e9355a60b73396ec7b113c8ca79d9999bd6b

Analysis

max time kernel
13s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 17:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_42dc5a7f733452a7f3cf8a5ba6726d0e_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remco.exe
Size 5.9MB
Sample260910-v62pmaea38
SHA256 ab3174e8c52576099d2040beffd9e9355a60b73396ec7b113c8ca79d9999bd6b
MD5 42dc5a7f733452a7f3cf8a5ba6726d0e
SHA1 d6bdd643031149e881ad92bbe5bf3d804f485c10
SHA512 2d5f6fee2b9606a3375e6c9a5a9601f238e53c5a947fc4454cd91a8ce1cf1649a38be9e44269091284b4841f0624ecea2cbadc1c530808b62ba5edc64f187068
SSDEEP 49152:5RU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPBq/UybpuD:5RUgTH2M2m9UMpu1QfLczqssnKSUjmNC
TLSH
T10556C41125DA9FDCC05FA474CE0669B16A237C468F61AFDF1980BE293E756B06E3810F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence

Malware Config

Signatures

Detects executables packed with ASPack 8 IoCs

resource	yara_rule
behavioral2/memory/2832-0-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c535-4.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2832-9-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2956-14-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c537-22.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5152-23-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2324-25-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2180-26-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c535-4.dat	aspack_v212_v242
behavioral2/files/0x000d00000001c537-22.dat	aspack_v212_v242

Executes dropped EXE 5 IoCs

pid	Process
2180	MSWDM.EXE
2324	MSWDM.EXE
3584	2026-09-10_42DC5A7F733452A7F3CF8A5BA6726D0E_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_NJRAT_REMCO.EXE
2956	MSWDM.EXE
5152	MSWDM.EXE

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	2026-09-10_42dc5a7f733452a7f3cf8a5ba6726d0e_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	2026-09-10_42dc5a7f733452a7f3cf8a5ba6726d0e_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remco.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\MSWDM.EXE	2026-09-10_42dc5a7f733452a7f3cf8a5ba6726d0e_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remco.exe
File opened for modification	C:\Windows\dev4E26.tmp	2026-09-10_42dc5a7f733452a7f3cf8a5ba6726d0e_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remco.exe
File opened for modification	C:\Windows\dev4E26.tmp	MSWDM.EXE

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_42dc5a7f733452a7f3cf8a5ba6726d0e_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remco.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_42DC5A7F733452A7F3CF8A5BA6726D0E_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_NJRAT_REMCO.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2324	MSWDM.EXE
2324	MSWDM.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 2180	2832	2026-09-10_42dc5a7f733452a7f3cf8a5ba6726d0e_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remco.exe	89
PID 2832 wrote to memory of 2324	2832	2026-09-10_42dc5a7f733452a7f3cf8a5ba6726d0e_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remco.exe	91
PID 2324 wrote to memory of 3584	2324	MSWDM.EXE	92
PID 2324 wrote to memory of 5152	2324	MSWDM.EXE	97

C:\Users\Admin\AppData\Local\Temp\2026-09-10_42dc5a7f733452a7f3cf8a5ba6726d0e_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remco.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_42dc5a7f733452a7f3cf8a5ba6726d0e_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remco.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2832
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2180
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\dev4E26.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-10_42dc5a7f733452a7f3cf8a5ba6726d0e_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remco.exe! !
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Users\Admin\AppData\Local\Temp\2026-09-10_42DC5A7F733452A7F3CF8A5BA6726D0E_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_NJRAT_REMCO.EXE
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3584
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\dev4E26.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-10_42DC5A7F733452A7F3CF8A5BA6726D0E_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_NJRAT_REMCO.EXE!
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:5152

C:\Windows\MSWDM.EXE
MSWDM.EXE
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-09-10_42dc5a7f733452a7f3cf8a5ba6726d0e_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remco.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-09-10_42dc5a7f733452a7f3cf8a5ba6726d0e_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remco.exe
Size 5.9MB
SHA256 abb0c218ec4ef1b9e260c23d653b0ad67846dacd0cc2f2d013bccbbf3cd5041c
MD5 a535b2ff3ca2489825c2492e59b4460e
SHA1 0a89df6f1903a56812afc916dd9b5c6a16d5be79
SHA512 540db56f978a11deae9bd84d024be018ac7106f1796c0b57ca55efc34b48d5979a5d38c745f9a6899d56f760757a7d5f36c3ace3ec0afa577997bcff11245a21
SSDEEP 49152:5RU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPBq/UybpuM:5RUgTH2M2m9UMpu1QfLczqssnKSUjmNp
TLSH
T16156C41125DA9FDCC05FA474CE0669B16A237C468F61AFDF1980BE293E756B06E3810F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSWDM.EXE

Path C:\Windows\MSWDM.EXE
Size 5.7MB
SHA256 e381a26400572565aee19b88d9c281c5c6ca2e693fe358c8b2fc3d930b5c747f
MD5 ef08ed84479abf774b93d92c7c541e7d
SHA1 bd56e58c21e0094aacebd3685232c0a1113030c2
SHA512 10924e0342c3727ed26c398b1c80f41532b0f4acb712a2e14b853b408c47cbbce830c4ec50e4cc90f9bbac9b093963bb8c549e9b6b2f2cde9b1351c94ce0ba55
SSDEEP 49152:5RU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPBq/Uybpuu:5RUgTH2M2m9UMpu1QfLczqssnKSh
TLSH
T14856B41125DA9FDCC05FA474CE0669E16A237C468F61AFDF1980BE293E756B06E3810F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dev4E26.tmp

Path C:\Windows\dev4E26.tmp
Size 242KB
SHA256 7fa8a5f008cc2ba5cc6c6908286e3b555b7dc0d41d119ee7e7785596391d0f32
MD5 0d0e2d55e442273ed08c54a64a47cec7
SHA1 bb6e8432775c4f1e32d2c7475cd7b3b57671990d
SHA512 217a050c22bf60d1186df27a853f87ab8478eaf9236a974e41352f1df972d1a11005eddcf4ee31b51aa3a554f706eda52334035191b664fd1da42889b8027834
SSDEEP 6144:gVzJ0J7guO92P2jsIVi5CnYav1882nSYy:izj4UsIVi5CnYjQYy
TLSH
T149347C307650C033D56716348AFAC7BA893EF8765B6140C7A7E8DFBD7E242C14A3924A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2180-26-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2324-25-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2832-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2832-9-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2956-14-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5152-23-0x0000000000400000-0x0000000000414000-memory.dmp

Download