80b953a3185f827b90645fc70af7a9a367685551e7095ccc694d1e2e19d8f10d

Analysis

max time kernel
14s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/09/2026, 12:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-13_9550ae4753f00a53801a67f0406ff68c_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_luca.exe
Size 6.6MB
Sample260913-plwpzsbb56
SHA256 80b953a3185f827b90645fc70af7a9a367685551e7095ccc694d1e2e19d8f10d
MD5 9550ae4753f00a53801a67f0406ff68c
SHA1 64571f9a1016c5a4bf4204d17765b70b1013a3a8
SHA512 1a72195826239a4271693c8b9cac1e6f73f4d0afefcf0ed7d58faa2d22671a6bdd5f963ac1a71ef7ebe0c9e9532f3c45d23622c1eb9e1a77b91757522d15ac22
SSDEEP 98304:ktkUgTH2M2m9UMpu1QfLczqssnKSS6MArOO53l:KgTH2qBpu1QfLIqsufS+D53l
TLSH
T1BF66E61162DA9FDCC05FE474CE0665A166237C458F61AFDF1980BE293E766B06E3820F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence

Malware Config

Signatures

Detects executables packed with ASPack 8 IoCs

resource	yara_rule
behavioral2/memory/1704-0-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c430-4.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1704-10-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5124-14-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2024-27-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c432-28.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1304-29-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3112-30-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 5 IoCs

pid	Process
3112	MSWDM.EXE
1304	MSWDM.EXE
552	2026-09-13_9550AE4753F00A53801A67F0406FF68C_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_IPAMOR_LUCA.EXE
5124	MSWDM.EXE
2024	MSWDM.EXE

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	2026-09-13_9550ae4753f00a53801a67f0406ff68c_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_luca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	2026-09-13_9550ae4753f00a53801a67f0406ff68c_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_luca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\MSWDM.EXE	2026-09-13_9550ae4753f00a53801a67f0406ff68c_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_luca.exe
File opened for modification	C:\Windows\dev1AE1.tmp	2026-09-13_9550ae4753f00a53801a67f0406ff68c_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_luca.exe
File opened for modification	C:\Windows\dev1AE1.tmp	MSWDM.EXE

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-13_9550AE4753F00A53801A67F0406FF68C_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_IPAMOR_LUCA.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-13_9550ae4753f00a53801a67f0406ff68c_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_luca.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1304	MSWDM.EXE
1304	MSWDM.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 3112	1704	2026-09-13_9550ae4753f00a53801a67f0406ff68c_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_luca.exe	88
PID 1704 wrote to memory of 1304	1704	2026-09-13_9550ae4753f00a53801a67f0406ff68c_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_luca.exe	89
PID 1304 wrote to memory of 552	1304	MSWDM.EXE	91
PID 1304 wrote to memory of 2024	1304	MSWDM.EXE	94

C:\Users\Admin\AppData\Local\Temp\2026-09-13_9550ae4753f00a53801a67f0406ff68c_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_luca.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-13_9550ae4753f00a53801a67f0406ff68c_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_luca.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1704
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3112
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\dev1AE1.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-13_9550ae4753f00a53801a67f0406ff68c_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_luca.exe! !
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1304
- - C:\Users\Admin\AppData\Local\Temp\2026-09-13_9550AE4753F00A53801A67F0406FF68C_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_IPAMOR_LUCA.EXE
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:552
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\dev1AE1.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-13_9550AE4753F00A53801A67F0406FF68C_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_IPAMOR_LUCA.EXE!
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2024

C:\Windows\MSWDM.EXE
MSWDM.EXE
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:5124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-09-13_9550AE4753F00A53801A67F0406FF68C_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_IPAMOR_LUCA.EXE

Path C:\Users\Admin\AppData\Local\Temp\2026-09-13_9550AE4753F00A53801A67F0406FF68C_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_IPAMOR_LUCA.EXE
Size 6.6MB
SHA256 fe4a9b21dd872c4c582c6ddec855b70ed3d0b87647d1d93c4c9c8fc0cf4d2458
MD5 7837f25291f5396d50196607976b436c
SHA1 d464cd1b99960b732344fc085cddca2aea06d43e
SHA512 4cc6e343e74887f5eeaa5120d7a949b2f983134d7a13b5c0a0cdb8fec3827c18593a1757f2727863e7cf6eeb7d92efcdad345baf808b56b7ca8b9d19931ae2e6
SSDEEP 98304:ktkUgTH2M2m9UMpu1QfLczqssnKSS6MArOO53P:KgTH2qBpu1QfLIqsufS+D53P
TLSH
T17366E61162DA9FDCC05FE474CE0665A166237C458F61AFDF1980BE293E766B06E3820F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSWDM.EXE

Path C:\Windows\MSWDM.EXE
Size 6.2MB
SHA256 cc57e3087bf9b3efdc052c58650fc27f4908dae11e88b6d90c0f123d525f2195
MD5 32f73d9ae38bee682ace5cece0b6013b
SHA1 4c3ee5f3415c60783a0887a3a4dc08f68a8ca2dc
SHA512 acf9a73d519041a1b3279a764e4daa6b088696ab5db7b9717578d2a2e476702c615623041b925d34b6452f2d9d2d67bc6a4f1fb3d12549d3a3c327f1eb9229a9
SSDEEP 49152:ktkU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPBq/Uybp6:ktkUgTH2M2m9UMpu1QfLczqssnKSS6M9
TLSH
T18C66D61161DA9FDCC05FE474CE0665A166237C468F61AFDF1980BE293E766B06E3820F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dev1AE1.tmp

Path C:\Windows\dev1AE1.tmp
Size 326KB
SHA256 7a2be844d6c626ece443d59fe3045c3ac776ea116bae56a1eba4aa28f2266c7c
MD5 5b48f7ea6b9f7abf0e1461adc83d0e49
SHA1 3565a8f1b3ce3fc732362345cc7cd6996061aab2
SHA512 1c441da0f1fab94f2bc39f818fa1500bdc04bd9626333f051bd25128ea991f616132f23ed0d38df464c7119b48016033cb362a52d985b959a482df3222f2aa54
SSDEEP 6144:VEJ5rX6GgcmDsL0vrxFsoAhnOkyiz53aJWTBP0tFwMYPgLESjIxvO1DoG:ePrXOcmFFgOkyU532WTh0tFhfa3G
TLSH
T1F4649D02BB96C173C96302725996632DD6B9B5710F3183D7B3E86B0DDE702E19932B87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1304-29-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1704-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1704-10-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2024-27-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3112-30-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5124-14-0x0000000000400000-0x0000000000414000-memory.dmp

Download