f8a6452d9ac8ffae068233039202541cd737c53a3fd0ad0b961c25eadf003462

Analysis

max time kernel
14s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/09/2026, 23:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-12_6b5e0c2958a360f9c52816d3762c5c78_akira_cobalt-strike_elex_njrat_vidar.exe
Size 4.0MB
Sample260912-31zbbahn2t
SHA256 f8a6452d9ac8ffae068233039202541cd737c53a3fd0ad0b961c25eadf003462
MD5 6b5e0c2958a360f9c52816d3762c5c78
SHA1 17fe4350432690de19f77dbdb938c2b1e3f7fc7a
SHA512 b8a110da8c46606daf733d4a172bd1aaf2c2321befe998e66997ad2ee7396e25ed95ec14187de9544e91abea3b000c0fb16fa9f2e1a02bfb530261a48f5e1ed6
SSDEEP 49152:5dsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPBq/Uybh:5mKUgTH2M2m9UMpu1QfLczqs4
TLSH
T11416C612655A2F6CD15FD474CB4B8915AA237C8A0F246BEF0285BD713E76AF42F38207
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence

Malware Config

Signatures

Custom signature

Detects executables packed with ASPack 8 IoCs

resource	yara_rule
behavioral2/memory/1800-0-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c517-6.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1800-11-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5984-18-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3728-21-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c519-19.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2952-24-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4188-25-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c517-6.dat	aspack_v212_v242
behavioral2/files/0x000c00000001c519-19.dat	aspack_v212_v242

Executes dropped EXE 5 IoCs

pid	Process
4188	MSWDM.EXE
3728	MSWDM.EXE
3900	2026-09-12_6B5E0C2958A360F9C52816D3762C5C78_AKIRA_COBALT-STRIKE_ELEX_NJRAT_VIDAR.EXE
5984	MSWDM.EXE
2952	MSWDM.EXE

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	2026-09-12_6b5e0c2958a360f9c52816d3762c5c78_akira_cobalt-strike_elex_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	2026-09-12_6b5e0c2958a360f9c52816d3762c5c78_akira_cobalt-strike_elex_njrat_vidar.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\MSWDM.EXE	2026-09-12_6b5e0c2958a360f9c52816d3762c5c78_akira_cobalt-strike_elex_njrat_vidar.exe
File opened for modification	C:\Windows\dev168C.tmp	2026-09-12_6b5e0c2958a360f9c52816d3762c5c78_akira_cobalt-strike_elex_njrat_vidar.exe
File opened for modification	C:\Windows\dev168C.tmp	MSWDM.EXE

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-12_6B5E0C2958A360F9C52816D3762C5C78_AKIRA_COBALT-STRIKE_ELEX_NJRAT_VIDAR.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-12_6b5e0c2958a360f9c52816d3762c5c78_akira_cobalt-strike_elex_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3728	MSWDM.EXE
3728	MSWDM.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 4188	1800	2026-09-12_6b5e0c2958a360f9c52816d3762c5c78_akira_cobalt-strike_elex_njrat_vidar.exe	87
PID 1800 wrote to memory of 3728	1800	2026-09-12_6b5e0c2958a360f9c52816d3762c5c78_akira_cobalt-strike_elex_njrat_vidar.exe	88
PID 3728 wrote to memory of 3900	3728	MSWDM.EXE	89
PID 3728 wrote to memory of 5984	3728	MSWDM.EXE	90

C:\Users\Admin\AppData\Local\Temp\2026-09-12_6b5e0c2958a360f9c52816d3762c5c78_akira_cobalt-strike_elex_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-12_6b5e0c2958a360f9c52816d3762c5c78_akira_cobalt-strike_elex_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1800
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4188
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\dev168C.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-12_6b5e0c2958a360f9c52816d3762c5c78_akira_cobalt-strike_elex_njrat_vidar.exe! !
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3728
- - C:\Users\Admin\AppData\Local\Temp\2026-09-12_6B5E0C2958A360F9C52816D3762C5C78_AKIRA_COBALT-STRIKE_ELEX_NJRAT_VIDAR.EXE
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3900
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\dev168C.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-12_6B5E0C2958A360F9C52816D3762C5C78_AKIRA_COBALT-STRIKE_ELEX_NJRAT_VIDAR.EXE!
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:5984

C:\Windows\MSWDM.EXE
MSWDM.EXE
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-09-12_6B5E0C2958A360F9C52816D3762C5C78_AKIRA_COBALT-STRIKE_ELEX_NJRAT_VIDAR.EXE

Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_6B5E0C2958A360F9C52816D3762C5C78_AKIRA_COBALT-STRIKE_ELEX_NJRAT_VIDAR.EXE
Size 4.0MB
SHA256 905d182deb1941a7f02c2f625701456d1216c2f29a5e906980d8e44cc0f9f0e8
MD5 4dba0eb7392a0c0b6ddfa32a740c0465
SHA1 4e5a99a62c5828f7e82573eb34362bdb7c095bea
SHA512 8c79339a1f50cf1fcf0dc149260ab01b11dab443d0c4382880c6631f4090bbaddd2315a88f3d6290d37225b0a5ea78498e2e3850e83d578d0f3417e32723a087
SSDEEP 49152:5dsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPBq/Uyba:5mKUgTH2M2m9UMpu1QfLczqsX
TLSH
T16B16C612655A2F6CD15FD474CB4B8915AA237C8A0F246BEF0285BD713E76AF42F38207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSWDM.EXE

Path C:\Windows\MSWDM.EXE
Size 4.0MB
SHA256 69449849fa7e3ee9f9bf4af8be7548950f44f3a7dffab3a174c598525a9e9b06
MD5 f7133b3343e9e5839442ccd126184012
SHA1 f88fe0f876ab675a299da0f14edbda0c8b47e1c4
SHA512 f065ace9f51c639061870ea9a7affc20efba5de4a802f948ab255b4ce1d8d91385866aff8be64502563346b16196678d5634af8b224f36b57caa591a8cf02cf2
SSDEEP 49152:5dsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPBq/Uybb:5mKUgTH2M2m9UMpu1QfLczqse
TLSH
T13216C612655A2F6CD55FD474CB4B8915AA237C8A0F246BEF0281BD713E76AF42F38207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dev168C.tmp

Path C:\Windows\dev168C.tmp
Size 35KB
SHA256 83b319e84cf953172fd2eb936904963d8e63fba9f8dc3eb1c66286cdfefc9fda
MD5 0f9ab080e111e1a2a655008cc7732c14
SHA1 b1250ef9c0e9d2bdc226c8a3e45b0a518ca0443d
SHA512 baea1464b3bab9852eb1c2623ab4ef370063e4898225f3758e577ca01792ebff603b78f750478deff72cfed1415fecc2455813ed92a321c68024ea4536ebddc7
SSDEEP 768:yYOIn0YEBAetvRVtNNL/QUPw9AoOSdtVt0tnIILnz:yw0YKVjNLQUPwBOwVt2rLz
TLSH
T124F26D272B164032E1435BB0ADE1E3578AFDB9730F74521BE3D891CE1EB4BA5DD21606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1800-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1800-11-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2952-24-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3728-21-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4188-25-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5984-18-0x0000000000400000-0x0000000000414000-memory.dmp

Download