94ef66f88a434284319f51046e5f54d112af33e13e557f8e678d578843007926

Analysis

max time kernel
15s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/09/2026, 03:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-12_321f4d651a79faffe922d7c20ba72bd7_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe
Size 8.7MB
Sample260913-ehqz8a1elf
SHA256 94ef66f88a434284319f51046e5f54d112af33e13e557f8e678d578843007926
MD5 321f4d651a79faffe922d7c20ba72bd7
SHA1 07aa796d4fafa897b5609c421502aca6164f1207
SHA512 dc6ca503d0ab6b1bc0f62d8c2dd63b31a57bd369baa9fbc54e0252d30676aa25e0ac1830cc33d90d0b3e55258d2c9b26c1105ea5fbcfdc07303759aa272ed0a1
SSDEEP 98304:5NUgTH2M2m9UMpu1QfLczqssnKSu6Oui+w32+QDENms2E:5+gTH2qBpu1QfLIqsufubui+LjENh
TLSH
T18A96172122D99FECC05FA430CE4A75B566237C458F61AFDF19807E293E756A06E3821F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence

Malware Config

Signatures

Detects executables packed with ASPack 8 IoCs

resource	yara_rule
behavioral2/memory/2972-0-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c4f0-4.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2972-11-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2936-21-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5988-24-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c4f2-19.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3628-18-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1316-25-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c4f0-4.dat	aspack_v212_v242
behavioral2/files/0x000d00000001c4f2-19.dat	aspack_v212_v242

Executes dropped EXE 5 IoCs

pid	Process
1316	MSWDM.EXE
2936	MSWDM.EXE
4560	2026-09-12_321F4D651A79FAFFE922D7C20BA72BD7_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_LUCA-STEALE.EXE
3628	MSWDM.EXE
5988	MSWDM.EXE

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	2026-09-12_321f4d651a79faffe922d7c20ba72bd7_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	2026-09-12_321f4d651a79faffe922d7c20ba72bd7_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\MSWDM.EXE	2026-09-12_321f4d651a79faffe922d7c20ba72bd7_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe
File opened for modification	C:\Windows\devC143.tmp	2026-09-12_321f4d651a79faffe922d7c20ba72bd7_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe
File opened for modification	C:\Windows\devC143.tmp	MSWDM.EXE

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-12_321f4d651a79faffe922d7c20ba72bd7_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-12_321F4D651A79FAFFE922D7C20BA72BD7_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_LUCA-STEALE.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2936	MSWDM.EXE
2936	MSWDM.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 1316	2972	2026-09-12_321f4d651a79faffe922d7c20ba72bd7_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe	86
PID 2972 wrote to memory of 2936	2972	2026-09-12_321f4d651a79faffe922d7c20ba72bd7_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe	87
PID 2936 wrote to memory of 4560	2936	MSWDM.EXE	88
PID 2936 wrote to memory of 3628	2936	MSWDM.EXE	90

C:\Users\Admin\AppData\Local\Temp\2026-09-12_321f4d651a79faffe922d7c20ba72bd7_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-12_321f4d651a79faffe922d7c20ba72bd7_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2972
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1316
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\devC143.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-12_321f4d651a79faffe922d7c20ba72bd7_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe! !
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2936
- - C:\Users\Admin\AppData\Local\Temp\2026-09-12_321F4D651A79FAFFE922D7C20BA72BD7_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_LUCA-STEALE.EXE
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4560
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\devC143.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-12_321F4D651A79FAFFE922D7C20BA72BD7_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_LUCA-STEALE.EXE!
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:3628

C:\Windows\MSWDM.EXE
MSWDM.EXE
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:5988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-09-12_321F4D651A79FAFFE922D7C20BA72BD7_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_LUCA-STEALE.EXE

Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_321F4D651A79FAFFE922D7C20BA72BD7_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_LUCA-STEALE.EXE
Size 8.7MB
SHA256 5ac46a793f5240f811aad3a6a6925c63d8d7448f5e72e15839bc5889e3d68e04
MD5 01a866a5cd4a57fb5eac4d0015aea3ce
SHA1 8fe37f81b231d4c4831ea9ea3c6666a724539573
SHA512 8df50ed08879d635279d9de6457b847bee5aff020c886e0dc38ddb4acf35225df33f3f22f3cdf15166ae5d59042ea88a5b04e9154244bbc87a6bdc6d9761418d
SSDEEP 98304:5NUgTH2M2m9UMpu1QfLczqssnKSu6Oui+w32+QDENms2T:5+gTH2qBpu1QfLIqsufubui+LjENa
TLSH
T17296172122D99FECC05FA430CE4A75B566237C458F61AFDF19807E293E756A06E3821F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-09-12_321f4d651a79faffe922d7c20ba72bd7_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_321f4d651a79faffe922d7c20ba72bd7_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe
Size 8.7MB
SHA256 dc077fcc24b856a2f22f0f095eccbc49dadb75ef4ded92d77ace76d1e76c8749
MD5 a7ad334b1bcf6768017217f8425f5ffa
SHA1 e14bf839d67d9c033c76f58feea78b2e4d02b860
SHA512 aa33b4f886864fa4afa0870f37d27b63dc979312f4d92a7214d25766cc8bde5eed88b439d3ce871ab95d00740340ecb1cd13cd25ea3498daf577f6b9963e9e08
SSDEEP 98304:egTH2M2m9UMpu1QfLczqssnKSu6Oui+w32+QDENms2T:egTH2qBpu1QfLIqsufubui+LjENa
TLSH
T1F596382122D99FEDC05FA130CE4A75A46623BC418F21AFDF19447E2A3E756A05F3921F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSWDM.EXE

Path C:\Windows\MSWDM.EXE
Size 6.0MB
SHA256 677cb4053198c5d242a6d4686b29772118834910a05af968479a6fa03507fc1b
MD5 1d8d9c50decc0a993e0570ee39c20ebc
SHA1 c55f40599ef267ed5bf8074204a036ac6a90fac7
SHA512 607817bb8d676e67ad8ecad36b80f1d1bb84ad14d52d4ae4508c4e5ad867e3cda945eca53b42db551588eecb56fac37a6cac6e0c9acf40d3a258da5eb07859a9
SSDEEP 49152:5NU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPBq/UybpuU:5NUgTH2M2m9UMpu1QfLczqssnKSu6R
TLSH
T1D956C51162DA9FDCC05FA474CE0669B16A237C468F61AFDF19807E293E756B06E3810F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

devC143.tmp

Path C:\Windows\devC143.tmp
Size 2.7MB
SHA256 20b1b637692a87fd194d457ec0ffe33c351363600c926c9ebd2455ad98a566c9
MD5 ce9bb918cf467639704c6c1352006ab0
SHA1 0031fc5e096629078a2bcfeeae2ee6dcb7e64f82
SHA512 c8500870c0318e00bc68ac97adbf318310e61d8f6135a97e52075d8c0b04c86a133ab076c740364191d432e1aba5588df59202abeec0527ad8e30f40750ad38a
SSDEEP 49152:l3BKBUvdWJTy4uia5w32OvfZcvkuRdLHkJEANmsvHHu34:Iui+w32+QDENms2I
TLSH
T18FD5AE2173D4D137D092A330CFEDB27877BBBA108566D31B251D2A6A78B13904F5A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1316-25-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2936-21-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2972-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2972-11-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3628-18-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5988-24-0x0000000000400000-0x0000000000414000-memory.dmp

Download