a565f71b325027fe93541acfecca2fdceed6f0d1afe0063410829093ebf9b1c1

Analysis

max time kernel
15s
max time network
3s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/09/2026, 07:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-12_022ef59720d1ee9b03d1449770eddb91_akira_cobalt-strike_elex_icedid_njrat_remcos_vidar.exe
Size 6.2MB
Sample260913-jabb1swsdx
SHA256 a565f71b325027fe93541acfecca2fdceed6f0d1afe0063410829093ebf9b1c1
MD5 022ef59720d1ee9b03d1449770eddb91
SHA1 36a50b015d051b4bafa7d7ec2167905449f2319a
SHA512 b26e5e7024541b2dc82ec73e37e792e02c055b5e23b66ef951a786f61be9864ec65977ae4e2800048d975356d10aa641ae9ada23a1cd3053789af5c085409ce9
SSDEEP 98304:/uUgTH2M2m9UMpu1QfLczqssnKSGs+wE9XD8VBQ:/xgTH2qBpu1QfLIqsufGV9z8o
TLSH
T18C664D12669A9FACC15FD474CA0749A16A237C864F61ABDF0180BE393F756F06F3811B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence

Malware Config

Signatures

Detects executables packed with ASPack 8 IoCs

resource	yara_rule
behavioral2/memory/4416-0-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c4f5-4.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4416-12-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4688-20-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c4f7-22.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3472-24-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4840-26-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5224-27-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c4f5-4.dat	aspack_v212_v242
behavioral2/files/0x000d00000001c4f7-22.dat	aspack_v212_v242

Executes dropped EXE 5 IoCs

pid	Process
5224	MSWDM.EXE
4840	MSWDM.EXE
1224	2026-09-12_022EF59720D1EE9B03D1449770EDDB91_AKIRA_COBALT-STRIKE_ELEX_ICEDID_NJRAT_REMCOS_VIDAR.EXE
4688	MSWDM.EXE
3472	MSWDM.EXE

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	2026-09-12_022ef59720d1ee9b03d1449770eddb91_akira_cobalt-strike_elex_icedid_njrat_remcos_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	2026-09-12_022ef59720d1ee9b03d1449770eddb91_akira_cobalt-strike_elex_icedid_njrat_remcos_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\MSWDM.EXE	2026-09-12_022ef59720d1ee9b03d1449770eddb91_akira_cobalt-strike_elex_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\dev55C7.tmp	2026-09-12_022ef59720d1ee9b03d1449770eddb91_akira_cobalt-strike_elex_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\dev55C7.tmp	MSWDM.EXE

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-12_022ef59720d1ee9b03d1449770eddb91_akira_cobalt-strike_elex_icedid_njrat_remcos_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-12_022EF59720D1EE9B03D1449770EDDB91_AKIRA_COBALT-STRIKE_ELEX_ICEDID_NJRAT_REMCOS_VIDAR.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4840	MSWDM.EXE
4840	MSWDM.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 5224	4416	2026-09-12_022ef59720d1ee9b03d1449770eddb91_akira_cobalt-strike_elex_icedid_njrat_remcos_vidar.exe	88
PID 4416 wrote to memory of 4840	4416	2026-09-12_022ef59720d1ee9b03d1449770eddb91_akira_cobalt-strike_elex_icedid_njrat_remcos_vidar.exe	89
PID 4840 wrote to memory of 1224	4840	MSWDM.EXE	91
PID 4840 wrote to memory of 4688	4840	MSWDM.EXE	92

C:\Users\Admin\AppData\Local\Temp\2026-09-12_022ef59720d1ee9b03d1449770eddb91_akira_cobalt-strike_elex_icedid_njrat_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-12_022ef59720d1ee9b03d1449770eddb91_akira_cobalt-strike_elex_icedid_njrat_remcos_vidar.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4416
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:5224
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\dev55C7.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-12_022ef59720d1ee9b03d1449770eddb91_akira_cobalt-strike_elex_icedid_njrat_remcos_vidar.exe! !
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Users\Admin\AppData\Local\Temp\2026-09-12_022EF59720D1EE9B03D1449770EDDB91_AKIRA_COBALT-STRIKE_ELEX_ICEDID_NJRAT_REMCOS_VIDAR.EXE
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1224
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\dev55C7.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-12_022EF59720D1EE9B03D1449770EDDB91_AKIRA_COBALT-STRIKE_ELEX_ICEDID_NJRAT_REMCOS_VIDAR.EXE!
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4688

C:\Windows\MSWDM.EXE
MSWDM.EXE
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-09-12_022EF59720D1EE9B03D1449770EDDB91_AKIRA_COBALT-STRIKE_ELEX_ICEDID_NJRAT_REMCOS_VIDAR.EXE

Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_022EF59720D1EE9B03D1449770EDDB91_AKIRA_COBALT-STRIKE_ELEX_ICEDID_NJRAT_REMCOS_VIDAR.EXE
Size 6.2MB
SHA256 291c5d524d3211563700a2c99954d7f94795223db124b36d85fbd119b59a9e28
MD5 98755e7aa36024c2356a7c6b11a0ce53
SHA1 0c677fb5a8aa3ac6a4b953eed6394debab0abeb8
SHA512 078c87e6be629f35ec94da2f0f5a70a5f021d6850f93aeb1733f612fe04327510a298157770e7ff1bc75181ad6a717763cd60accebfe80c9c4a314671b771de3
SSDEEP 98304:/uUgTH2M2m9UMpu1QfLczqssnKSGs+wE9XD8VB3:/xgTH2qBpu1QfLIqsufGV9z8v
TLSH
T1AB664D12669A9FACC15FD474CA0749A16A237C864F61ABDF0180BE393F756F06F3811B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-09-12_022ef59720d1ee9b03d1449770eddb91_akira_cobalt-strike_elex_icedid_njrat_remcos_vidar.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_022ef59720d1ee9b03d1449770eddb91_akira_cobalt-strike_elex_icedid_njrat_remcos_vidar.exe
Size 6.2MB
SHA256 9830a6d5a0693fde5085b6379d3b04b690d2ed890ba9cf103e9b966ee2715177
MD5 5c79fd723abd69d53b2b600978cb07dc
SHA1 7d78f0566d054fb9368e3714ea672bcff675d73e
SHA512 4e1bd25a4b56c2c17095752347016a48f9e2ec4cf90133887bcf6f47d66a0308dfc31f856e7371f0a50e2b19fa11d063bc686098b06648a8f92b842566d2991c
SSDEEP 98304:4s+wngTH2M2m9UMpu1QfLczqssnKSGs+wE9XD8VB3:4OgTH2qBpu1QfLIqsufGV9z8v
TLSH
T157666E12669A9FACC15FD474CA0659A16A337C864F61ABDF01807E393F756F06F3820B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSWDM.EXE

Path C:\Windows\MSWDM.EXE
Size 5.4MB
SHA256 5251fc7ee9ca2768574cb0870654c32044617ac56bdde04e6ef1ed0f637e8d83
MD5 3e0d86eb2a3acc9d0e9143d7aaf2bba5
SHA1 f324a45d156b5260ae6313503b68ece2a5600e80
SHA512 ae1411ddcae5eb9698bd170f0d5db58d7c3c5d76515bfe3a6bb40a296181cbd76025225905b362f3ddba283feccc1f124645ea4552db133e225226b08eaced93
SSDEEP 49152:/uU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPBq/UybpuQ:/uUgTH2M2m9UMpu1QfLczqssnKS9
TLSH
T1D0463D12669A9F9CC15FD474CA0749A16A237C864F61ABDF0180BE393F766F46F3810B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dev55C7.tmp

Path C:\Windows\dev55C7.tmp
Size 794KB
SHA256 2435e1e50c097608e6157efb1036946cfdd02d86728e8e00a02b207bee36e60d
MD5 c6d0721e9156eb2a40a04bb38be0b2a5
SHA1 d0a3fcb3ad9f227a02d30abb767883b42fecc3a7
SHA512 e254db10a7cffc4fe8c2d126dc4eb5029a84b2a931a67ad9ebfd04a8f3417e42a7dfb2e76d8911b2540bcf9eff9cbf92708b158dd8f53dbcbe7be51682ac3ad4
SSDEEP 24576:F3LutmkEz+PAVV/OOInO4Xs2ztR4iegxLHgZpJE4VDd+:FbutmkO+wAOInO4XrztygxLHkJE4VB
TLSH
T1A505D022F3D0A536D7631331993A7231BBBE66301A128B136B541F957FA61E16F2C363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3472-24-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4416-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4416-12-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4688-20-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4840-26-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5224-27-0x0000000000400000-0x0000000000414000-memory.dmp

Download