53e6f159ec54c4f3fe88aa30a32801a3e6d0b5a32f3bbb6b879c6baace273b98

Analysis

max time kernel
14s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/09/2026, 02:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-12_4edb15da667a7694a336b3e93726c45a_akira_cobalt-strike_darkgate_elex_glassworm_icedid_njrat_vidar.exe
Size 4.3MB
Sample260913-cgmkasdf74
SHA256 53e6f159ec54c4f3fe88aa30a32801a3e6d0b5a32f3bbb6b879c6baace273b98
MD5 4edb15da667a7694a336b3e93726c45a
SHA1 adfd816de3706e33cd23cf2f310df95fedf5f131
SHA512 3295f26735340feeb9e11e546814eed33eaa810c1a8f26b5bc7fbd1e6f5565f4e10affeca7cb07fcead1c3f526c261348964d306a3118beac3ff8fd3e0cd725b
SSDEEP 49152:5xU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPBq/UybpuG:5xUgTH2M2m9UMpu1QfLczqsdAP
TLSH
T19826E71265592F6CD15FD478CB4B8915AA277C8A0F346BEF0281AD713E76AF42F38207
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence

Malware Config

Signatures

Detects executables packed with ASPack 8 IoCs

resource	yara_rule
behavioral2/memory/4368-0-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c58c-6.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4368-10-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/904-17-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c58e-23.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2680-22-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3216-25-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5672-26-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c58c-6.dat	aspack_v212_v242
behavioral2/files/0x000d00000001c58e-23.dat	aspack_v212_v242

Executes dropped EXE 5 IoCs

pid	Process
5672	MSWDM.EXE
3216	MSWDM.EXE
1492	2026-09-12_4EDB15DA667A7694A336B3E93726C45A_AKIRA_COBALT-STRIKE_DARKGATE_ELEX_GLASSWORM_ICEDID_NJRAT_VIDAR.EXE
904	MSWDM.EXE
2680	MSWDM.EXE

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	2026-09-12_4edb15da667a7694a336b3e93726c45a_akira_cobalt-strike_darkgate_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	2026-09-12_4edb15da667a7694a336b3e93726c45a_akira_cobalt-strike_darkgate_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\MSWDM.EXE	2026-09-12_4edb15da667a7694a336b3e93726c45a_akira_cobalt-strike_darkgate_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\dev4D8.tmp	2026-09-12_4edb15da667a7694a336b3e93726c45a_akira_cobalt-strike_darkgate_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\dev4D8.tmp	MSWDM.EXE

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-12_4edb15da667a7694a336b3e93726c45a_akira_cobalt-strike_darkgate_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-12_4EDB15DA667A7694A336B3E93726C45A_AKIRA_COBALT-STRIKE_DARKGATE_ELEX_GLASSWORM_ICEDID_NJRAT_VIDAR.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3216	MSWDM.EXE
3216	MSWDM.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 5672	4368	2026-09-12_4edb15da667a7694a336b3e93726c45a_akira_cobalt-strike_darkgate_elex_glassworm_icedid_njrat_vidar.exe	87
PID 4368 wrote to memory of 3216	4368	2026-09-12_4edb15da667a7694a336b3e93726c45a_akira_cobalt-strike_darkgate_elex_glassworm_icedid_njrat_vidar.exe	88
PID 3216 wrote to memory of 1492	3216	MSWDM.EXE	89
PID 3216 wrote to memory of 2680	3216	MSWDM.EXE	93

C:\Users\Admin\AppData\Local\Temp\2026-09-12_4edb15da667a7694a336b3e93726c45a_akira_cobalt-strike_darkgate_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-12_4edb15da667a7694a336b3e93726c45a_akira_cobalt-strike_darkgate_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4368
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:5672
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\dev4D8.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-12_4edb15da667a7694a336b3e93726c45a_akira_cobalt-strike_darkgate_elex_glassworm_icedid_njrat_vidar.exe! !
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3216
- - C:\Users\Admin\AppData\Local\Temp\2026-09-12_4EDB15DA667A7694A336B3E93726C45A_AKIRA_COBALT-STRIKE_DARKGATE_ELEX_GLASSWORM_ICEDID_NJRAT_VIDAR.EXE
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1492
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\dev4D8.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-12_4EDB15DA667A7694A336B3E93726C45A_AKIRA_COBALT-STRIKE_DARKGATE_ELEX_GLASSWORM_ICEDID_NJRAT_VIDAR.EXE!
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2680

C:\Windows\MSWDM.EXE
MSWDM.EXE
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-09-12_4EDB15DA667A7694A336B3E93726C45A_AKIRA_COBALT-STRIKE_DARKGATE_ELEX_GLASSWORM_ICEDID_NJRAT_VIDAR.EXE

Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_4EDB15DA667A7694A336B3E93726C45A_AKIRA_COBALT-STRIKE_DARKGATE_ELEX_GLASSWORM_ICEDID_NJRAT_VIDAR.EXE
Size 4.3MB
SHA256 ebd67c4ab119f3df83461f577a1646ca4222088d33388b425cf8e3a7ffa381e7
MD5 2563e906d080741ace3cd58df812cdb3
SHA1 9b4e5ce32601e98a62188015ab14ea4cef1f70ac
SHA512 eca14a042c0d75c685e794419f2af13815063485bd4d5b052b793a7650f20f96f49b4a31fdea542a949957786b773df2aae11f729c377426540d6a964d82f018
SSDEEP 49152:5xU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPBq/Uybpuh:5xUgTH2M2m9UMpu1QfLczqsdAM
TLSH
T16826E71265592F6CD15FD478CB4B8915AA277C8A0F346BEF0281AD713E76AF42F38207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSWDM.EXE

Path C:\Windows\MSWDM.EXE
Size 4.0MB
SHA256 e0f08fe4f9907fffcf7fbfd5584a0a82f47c59e115c58b332f351004cc818326
MD5 51479605f46387e17935263af741ec48
SHA1 04496bb896ec588525c51d9918b9e8cea0b0edba
SHA512 6b9620406ddc1426fc9af752b9fa682ce23955fe50bbbd10c338f802aa76785cbeec5f1fbd881f38130ce7ef296124c508bc7184980b2c5a34dc0cd8dc391422
SSDEEP 49152:5xU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPBq/UybpuY:5xUgTH2M2m9UMpu1QfLczqsU
TLSH
T1DE16B612655A2F6CD15FD474CB4B8915AA237C8A0F356BEF0281AD713E76AF42F38207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dev4D8.tmp

Path C:\Windows\dev4D8.tmp
Size 354KB
SHA256 42568fd854d54c6216acff4c3e4d18b02a267e059359bb817e9af8e369213694
MD5 d1fcc548de90f7aeafba90d43df416e0
SHA1 b43b8324fa7dbaf4fd224b48fe655eb7981174c8
SHA512 c8dbd079d2c883deb254c6d9b0058541db0e8ba144c4646fc332c8d07b54e85dc5e0e5dfa1db67fc64fc8044325a00cfd2ad647671ad1c60c11e627a1b9b6abc
SSDEEP 6144:8IPYA1y62zvnJgQanl0R3QDtM5o6Oiq6kgMhXmwx5+eJiXgJsNkTHOB2tIe4WooB:LP062lPu6o6OikD9LJKgJs2TuB2tIg3B
TLSH
T100747C639A00C9B2D8CA15BD552833159FDCA8E4032192F7668846DEC55FAD02F3EFDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/904-16-0x0000000002040000-0x0000000002046000-memory.dmp

Download

memory/904-17-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2680-22-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3216-25-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4368-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4368-10-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5672-26-0x0000000000400000-0x0000000000414000-memory.dmp

Download