53f03f6038c12a10711437467a8aaa0c6bb811a200bdd428afffacd1807105b1

Analysis

max time kernel
16s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/09/2026, 09:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-11_6f6e7e34b03c34b45789a994bbb2d77a_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe
Size 9.6MB
Sample260912-k38cwsshje
SHA256 53f03f6038c12a10711437467a8aaa0c6bb811a200bdd428afffacd1807105b1
MD5 6f6e7e34b03c34b45789a994bbb2d77a
SHA1 252056b2c93578aafa54996b6ad1b460eada43b8
SHA512 45d309f84f3374ed18b4125502a61f59777c10f459436b8193d58e8e5710ab5c6cf8ed16341a72693d31523a20def8658a469ee600774d8b59c2849117bc543f
SSDEEP 98304:kt8UgTH2M2m9UMpu1QfLczqssnKS5dl6kfkZcyfkZcT4kRAuFkkmd:OgTH2qBpu1QfLIqsuf5dl1PsPIuFXmd
TLSH
T109A6191162E98FA9C06FD074CD566AA5A9337C458F209FDF0580BE293E366F09E3521F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence

Malware Config

Signatures

Detects executables packed with ASPack 8 IoCs

resource	yara_rule
behavioral2/memory/4244-0-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c596-8.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4244-9-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2352-14-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2108-18-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c598-19.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1248-20-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5732-21-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 5 IoCs

pid	Process
5732	MSWDM.EXE
1248	MSWDM.EXE
5464	2026-09-11_6F6E7E34B03C34B45789A994BBB2D77A_AKIRA_AMADEY_COBALT-STRIKE_DARKGATE_ELEX_HIJACKLOADER_IC.EXE
2352	MSWDM.EXE
2108	MSWDM.EXE

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	2026-09-11_6f6e7e34b03c34b45789a994bbb2d77a_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	2026-09-11_6f6e7e34b03c34b45789a994bbb2d77a_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\dev4750.tmp	2026-09-11_6f6e7e34b03c34b45789a994bbb2d77a_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe
File opened for modification	C:\Windows\dev4750.tmp	MSWDM.EXE
File created	C:\WINDOWS\MSWDM.EXE	2026-09-11_6f6e7e34b03c34b45789a994bbb2d77a_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-11_6f6e7e34b03c34b45789a994bbb2d77a_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-11_6F6E7E34B03C34B45789A994BBB2D77A_AKIRA_AMADEY_COBALT-STRIKE_DARKGATE_ELEX_HIJACKLOADER_IC.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1248	MSWDM.EXE
1248	MSWDM.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4244 wrote to memory of 5732	4244	2026-09-11_6f6e7e34b03c34b45789a994bbb2d77a_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe	87
PID 4244 wrote to memory of 1248	4244	2026-09-11_6f6e7e34b03c34b45789a994bbb2d77a_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe	88
PID 1248 wrote to memory of 5464	1248	MSWDM.EXE	90
PID 1248 wrote to memory of 2108	1248	MSWDM.EXE	92

C:\Users\Admin\AppData\Local\Temp\2026-09-11_6f6e7e34b03c34b45789a994bbb2d77a_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-11_6f6e7e34b03c34b45789a994bbb2d77a_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4244
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:5732
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\dev4750.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-11_6f6e7e34b03c34b45789a994bbb2d77a_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe! !
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1248
- - C:\Users\Admin\AppData\Local\Temp\2026-09-11_6F6E7E34B03C34B45789A994BBB2D77A_AKIRA_AMADEY_COBALT-STRIKE_DARKGATE_ELEX_HIJACKLOADER_IC.EXE
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5464
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\dev4750.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-11_6F6E7E34B03C34B45789A994BBB2D77A_AKIRA_AMADEY_COBALT-STRIKE_DARKGATE_ELEX_HIJACKLOADER_IC.EXE!
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2108

C:\Windows\MSWDM.EXE
MSWDM.EXE
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-09-11_6F6E7E34B03C34B45789A994BBB2D77A_AKIRA_AMADEY_COBALT-STRIKE_DARKGATE_ELEX_HIJACKLOADER_IC.EXE

Path C:\Users\Admin\AppData\Local\Temp\2026-09-11_6F6E7E34B03C34B45789A994BBB2D77A_AKIRA_AMADEY_COBALT-STRIKE_DARKGATE_ELEX_HIJACKLOADER_IC.EXE
Size 9.6MB
SHA256 32892b26ce2aa58bf768934b0bdf8e059febb3cc61e4717eaadba464e82843f0
MD5 01178c9d6a730cae512b58cb4edd9c2e
SHA1 de536571b6f5df286c76a9f4f0f9cfbbca06966d
SHA512 060199c79d809187f002165693318a6b55d8cf9371ada8249218a6cca46092d77b24b7c24a69e1cf670c8924af07d7c19407710e4ea667a034bcf6aef078e2ab
SSDEEP 98304:kt8UgTH2M2m9UMpu1QfLczqssnKS5dl6kfkZcyfkZcT4kRAuFkkm0:OgTH2qBpu1QfLIqsuf5dl1PsPIuFXm0
TLSH
T136A6191162E98FA9C06FD074CD566AA5A9337C458F209FDF0580BE293E366F09E3521F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSWDM.EXE

Path C:\Windows\MSWDM.EXE
Size 8.3MB
SHA256 411160cb49e6cd287fe0168f1c17ab51d5f8cc46577514355796c064434526ee
MD5 0f2b240852eb5940e457640479e852c9
SHA1 3bba308721648da6665000fa1a4d292e51029d8d
SHA512 d54d6462682f033680eccfce9fc4652859d4c6f028e11754b15e680ce93f514922640cde649dbb19e2c116430b1fd2beb9c2980e3e99ad41ccf0278c7a725e6f
SSDEEP 98304:kt8UgTH2M2m9UMpu1QfLczqssnKS5dl6kfkZcyfkZcj:OgTH2qBpu1QfLIqsuf5dl1PsPj
TLSH
T1E996F81166E98FD9C06FD474CD466AA5AA333C458F209FDF0981BE293E366E05E3421F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dev4750.tmp

Path C:\Windows\dev4750.tmp
Size 1.3MB
SHA256 1c52b50019786ce77c3338f470a9193f90f71080196198357744cb065b7c6851
MD5 ca0c67ba7aeba6aed5ddb852e6eea811
SHA1 8b8db3434cac650ba795ff9aa8f89a24e4b83410
SHA512 014fc45aa3141e160d5e78b963f065b196c7243ef0e630954de255b787d788f43f443b7a9a69c3b8b6f9e93e3f6ef25fe8ccfc7101fb196358b3459d4d6ec016
SSDEEP 24576:ifrPEmDvg1eg8lYLkpSFZmr8lcrNJZECOHUNt7nizsX4O8b8ITDnlq+YV:vmDvkRAuFkuoJZEtMFniQX4O8b8ITDn+
TLSH
T129556D30F6428136E8E271719E79AF5D682DA93007A640C772C91B191F716F2EF3AB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1248-20-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2108-18-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2352-14-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4244-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4244-9-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5732-21-0x0000000000400000-0x0000000000414000-memory.dmp

Download