15ec71f3b9f4eb0bb065d61cd8785df6717aed3181600fbac6faaf310450f408

Analysis

max time kernel
12s
max time network
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/09/2026, 19:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-12_ec1e5284decd2eb6b45e2842e8e5b4bc_akira_cobalt-strike_elex_icedid_ipamor_njrat_rhadamanthys_vidar.exe
Size 4.4MB
Sample260913-ynsksavyew
SHA256 15ec71f3b9f4eb0bb065d61cd8785df6717aed3181600fbac6faaf310450f408
MD5 ec1e5284decd2eb6b45e2842e8e5b4bc
SHA1 183bcb20cbf4ac77b72a01ce0394b6ab98cec56e
SHA512 82be2e648fadf4d0e5b6435dcc8d204e72c92d64cfd8ffca0b37ec63cd832477732257bd130927d84cd39ec5c3f9316fd09ae1f95b4e871a1d113e4c10091b03
SSDEEP 49152:ktUU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPBq/Uybpo:ktUUgTH2M2m9UMpu1QfLczqssnKR
TLSH
T1E226E712665A2F6CD15FD474CA4B8916AA337C8A0F216BEF4281BD353E766F42F38107
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence

Malware Config

Signatures

Detects executables packed with ASPack 8 IoCs

resource	yara_rule
behavioral2/memory/2688-0-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c4ee-4.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2688-9-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5336-16-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4820-18-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c4f0-17.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2796-20-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4888-21-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 5 IoCs

pid	Process
4888	MSWDM.EXE
4820	MSWDM.EXE
4948	2026-09-12_EC1E5284DECD2EB6B45E2842E8E5B4BC_AKIRA_COBALT-STRIKE_ELEX_ICEDID_IPAMOR_NJRAT_RHADAMANTHYS_VIDAR.EXE
5336	MSWDM.EXE
2796	MSWDM.EXE

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	2026-09-12_ec1e5284decd2eb6b45e2842e8e5b4bc_akira_cobalt-strike_elex_icedid_ipamor_njrat_rhadamanthys_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	2026-09-12_ec1e5284decd2eb6b45e2842e8e5b4bc_akira_cobalt-strike_elex_icedid_ipamor_njrat_rhadamanthys_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\MSWDM.EXE	2026-09-12_ec1e5284decd2eb6b45e2842e8e5b4bc_akira_cobalt-strike_elex_icedid_ipamor_njrat_rhadamanthys_vidar.exe
File opened for modification	C:\Windows\dev7DA2.tmp	2026-09-12_ec1e5284decd2eb6b45e2842e8e5b4bc_akira_cobalt-strike_elex_icedid_ipamor_njrat_rhadamanthys_vidar.exe
File opened for modification	C:\Windows\dev7DA2.tmp	MSWDM.EXE

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-12_EC1E5284DECD2EB6B45E2842E8E5B4BC_AKIRA_COBALT-STRIKE_ELEX_ICEDID_IPAMOR_NJRAT_RHADAMANTHYS_VIDAR.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-12_ec1e5284decd2eb6b45e2842e8e5b4bc_akira_cobalt-strike_elex_icedid_ipamor_njrat_rhadamanthys_vidar.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4820	MSWDM.EXE
4820	MSWDM.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 4888	2688	2026-09-12_ec1e5284decd2eb6b45e2842e8e5b4bc_akira_cobalt-strike_elex_icedid_ipamor_njrat_rhadamanthys_vidar.exe	87
PID 2688 wrote to memory of 4820	2688	2026-09-12_ec1e5284decd2eb6b45e2842e8e5b4bc_akira_cobalt-strike_elex_icedid_ipamor_njrat_rhadamanthys_vidar.exe	88
PID 4820 wrote to memory of 4948	4820	MSWDM.EXE	89
PID 4820 wrote to memory of 5336	4820	MSWDM.EXE	91

C:\Users\Admin\AppData\Local\Temp\2026-09-12_ec1e5284decd2eb6b45e2842e8e5b4bc_akira_cobalt-strike_elex_icedid_ipamor_njrat_rhadamanthys_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-12_ec1e5284decd2eb6b45e2842e8e5b4bc_akira_cobalt-strike_elex_icedid_ipamor_njrat_rhadamanthys_vidar.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2688
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4888
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\dev7DA2.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-12_ec1e5284decd2eb6b45e2842e8e5b4bc_akira_cobalt-strike_elex_icedid_ipamor_njrat_rhadamanthys_vidar.exe! !
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4820
- - C:\Users\Admin\AppData\Local\Temp\2026-09-12_EC1E5284DECD2EB6B45E2842E8E5B4BC_AKIRA_COBALT-STRIKE_ELEX_ICEDID_IPAMOR_NJRAT_RHADAMANTHYS_VIDAR.EXE
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4948
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\dev7DA2.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-12_EC1E5284DECD2EB6B45E2842E8E5B4BC_AKIRA_COBALT-STRIKE_ELEX_ICEDID_IPAMOR_NJRAT_RHADAMANTHYS_VIDAR.EXE!
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:5336

C:\Windows\MSWDM.EXE
MSWDM.EXE
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-09-12_EC1E5284DECD2EB6B45E2842E8E5B4BC_AKIRA_COBALT-STRIKE_ELEX_ICEDID_IPAMOR_NJRAT_RHADAMANTHYS_VIDAR.EXE

Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_EC1E5284DECD2EB6B45E2842E8E5B4BC_AKIRA_COBALT-STRIKE_ELEX_ICEDID_IPAMOR_NJRAT_RHADAMANTHYS_VIDAR.EXE
Size 4.4MB
SHA256 b246df945dd2a47e2af00202fdbaba5301151e890c986e2aaf8c6ff2d444787a
MD5 27c1d6d6a2afa709152d588907f21467
SHA1 906ee86a4774ba1dc3594c81778abc32ce077847
SHA512 e3d647c3064a3b0e5fb1cee5339185668d10fdb97c8ace161f5c65b6b36754790ca8be8c5fc2a342f9e18f32a9ca8690f662275c65c85da60e7cb8b3e1bc25ce
SSDEEP 49152:ktUU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPBq/UybpN:ktUUgTH2M2m9UMpu1QfLczqssnKM
TLSH
T13526E712665A2F6CD15FD474CA4B8916AA337C8A0F216BEF4281BD353E766F42F38107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSWDM.EXE

Path C:\Windows\MSWDM.EXE
Size 4.3MB
SHA256 cfd3fe29f0aa56733f2d99a0ac858122b7448ee8a370bf72237daa99d3878143
MD5 1bde367ec1570b1006f8e15e5a634217
SHA1 92fbf791208da003d210176379ebeaaf87d38263
SHA512 526ef92c64a21b0d461440d88f90f7fa96415f31f2a99c94a05a09636a63dccbffe3b5d5ff5313bed20244f62318349f7a01376471974e3aebd2feb5df398f34
SSDEEP 49152:ktUU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPBq/Uybp3:ktUUgTH2M2m9UMpu1QfLczqssnKy
TLSH
T1BC26D712665A2F6CD15FD474CB4B8916AA237C8A0F216BEF4281BD353E766F42F38107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dev7DA2.tmp

Path C:\Windows\dev7DA2.tmp
Size 57KB
SHA256 e8d0f855c88ca621d0c9936d52844307284d6286ce168076348735359ad518ce
MD5 d62af8d56065619e3189563099185c45
SHA1 43df83b1aaa7b79dc1695f6fdc3b5773ee5b3539
SHA512 1a64ffad9e700195452c578276617550258b74f7ef983e57d5a61c1f28e50358e190145f1d08c94ffde0facffd7094febb626989cf934c307f9c32ba078a7169
SSDEEP 1536:aqG8I8pk4gB/hZdtcSvJBi+qfLiHae0ko:cj8pk4gB/hZPBRB9qf3F
TLSH
T1EE434C06F654D63CE0730A3579AAE51066BABA60D912873F73B47F0B3E713C28726653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2688-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2688-9-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2796-20-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4820-18-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4888-21-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5336-16-0x0000000000400000-0x0000000000414000-memory.dmp

Download