e590c26c811be83f8bf2349a0cbce9fb71860887d912c3994b3e07729c56508c

Analysis

max time kernel
14s
max time network
118s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/09/2026, 20:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-12_ea16b86493e19f8b6052ea11c90d6786_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
Size 4.8MB
Sample260913-yr2ymadj6t
SHA256 e590c26c811be83f8bf2349a0cbce9fb71860887d912c3994b3e07729c56508c
MD5 ea16b86493e19f8b6052ea11c90d6786
SHA1 7a847d9ab997d75008fa8c91c15f7fce2a8cf177
SHA512 65deffa1a4a391f4a163296450041295081f8a77116b979081798f5c377aa8c599e5422280296787462626b7bd33b1c139bf2a031764fa06083462804daf6e03
SSDEEP 98304:5yUgTH2M2m9UMpu1QfLczqsBs+wE9XD8VBx:5dgTH2qBpu1QfLIqsBV9z85
TLSH
T16036F812655A2F6CD15FD074CB4B8915AA277C8A0F356BEF0281AD713E76AF42F38207
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence

Malware Config

Signatures

Detects executables packed with ASPack 8 IoCs

resource	yara_rule
behavioral2/memory/4528-0-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x001500000001c4d0-8.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4528-11-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4544-22-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000700000001b8af-23.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4976-27-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4688-25-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1640-28-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x001500000001c4d0-8.dat	aspack_v212_v242
behavioral2/files/0x000700000001b8af-23.dat	aspack_v212_v242

Executes dropped EXE 5 IoCs

pid	Process
1640	MSWDM.EXE
4688	MSWDM.EXE
824	2026-09-12_EA16B86493E19F8B6052EA11C90D6786_AKIRA_COBALT-STRIKE_ELEX_ICEDID_NJRAT_VIDAR.EXE
4544	MSWDM.EXE
4976	MSWDM.EXE

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	2026-09-12_ea16b86493e19f8b6052ea11c90d6786_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	2026-09-12_ea16b86493e19f8b6052ea11c90d6786_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\MSWDM.EXE	2026-09-12_ea16b86493e19f8b6052ea11c90d6786_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\dev527B.tmp	2026-09-12_ea16b86493e19f8b6052ea11c90d6786_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\dev527B.tmp	MSWDM.EXE

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-12_ea16b86493e19f8b6052ea11c90d6786_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-12_EA16B86493E19F8B6052EA11C90D6786_AKIRA_COBALT-STRIKE_ELEX_ICEDID_NJRAT_VIDAR.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4688	MSWDM.EXE
4688	MSWDM.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 1640	4528	2026-09-12_ea16b86493e19f8b6052ea11c90d6786_akira_cobalt-strike_elex_icedid_njrat_vidar.exe	89
PID 4528 wrote to memory of 4688	4528	2026-09-12_ea16b86493e19f8b6052ea11c90d6786_akira_cobalt-strike_elex_icedid_njrat_vidar.exe	90
PID 4688 wrote to memory of 824	4688	MSWDM.EXE	91
PID 4688 wrote to memory of 4544	4688	MSWDM.EXE	93

C:\Users\Admin\AppData\Local\Temp\2026-09-12_ea16b86493e19f8b6052ea11c90d6786_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-12_ea16b86493e19f8b6052ea11c90d6786_akira_cobalt-strike_elex_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4528
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1640
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\dev527B.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-12_ea16b86493e19f8b6052ea11c90d6786_akira_cobalt-strike_elex_icedid_njrat_vidar.exe! !
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Users\Admin\AppData\Local\Temp\2026-09-12_EA16B86493E19F8B6052EA11C90D6786_AKIRA_COBALT-STRIKE_ELEX_ICEDID_NJRAT_VIDAR.EXE
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:824
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\dev527B.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-12_EA16B86493E19F8B6052EA11C90D6786_AKIRA_COBALT-STRIKE_ELEX_ICEDID_NJRAT_VIDAR.EXE!
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4544

C:\Windows\MSWDM.EXE
MSWDM.EXE
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-09-12_EA16B86493E19F8B6052EA11C90D6786_AKIRA_COBALT-STRIKE_ELEX_ICEDID_NJRAT_VIDAR.EXE

Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_EA16B86493E19F8B6052EA11C90D6786_AKIRA_COBALT-STRIKE_ELEX_ICEDID_NJRAT_VIDAR.EXE
Size 4.8MB
SHA256 ed874177f65770fb5d377e5026da78ddf7e673fac1872f37d327f0c4a7a4892c
MD5 033b3df1ba27c334e97c867dbc2c3dd2
SHA1 d3c8d93acab5150bcfadbaa25128378c803f2e66
SHA512 cd23ddd1de4d6074f83f1c7a897a015ee98395f2fb836a2c9d7110ceb6cc844beebf5a04092a3ab66b0cf0e47f0d84f7160c56aae117fcd549d2c2caa73f882c
SSDEEP 98304:5yUgTH2M2m9UMpu1QfLczqsBs+wE9XD8VB9:5dgTH2qBpu1QfLIqsBV9z81
TLSH
T11436F812655A2F6CD15FD074CB4B8915AA277C8A0F356BEF0281AD713E76AF42F38207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-09-12_ea16b86493e19f8b6052ea11c90d6786_akira_cobalt-strike_elex_icedid_njrat_vidar.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_ea16b86493e19f8b6052ea11c90d6786_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
Size 4.8MB
SHA256 c7f656048cb315602044357f9b399a6ec9ebedfcf7ac14bac053ee4bc724878d
MD5 2ac820b136c05bff1fcbc6a289905293
SHA1 6c616092794b39d900ebbd25a5e6cdccc12f6a81
SHA512 47f1bbb3bcea5615361edfdd5cb375f01b1dce2cfaa58885ff22a79a6d676b51a7e3488a83e96d222c30dfbaa1437dd985eb2b7881f62aba803a218f192686b5
SSDEEP 98304:4yUgTH2M2m9UMpu1QfLczqsBs+wE9XD8VB9:4dgTH2qBpu1QfLIqsBV9z81
TLSH
T102363C12665A2E6CD15FD074CB4B8915AE367C9A0F346BEF02819D713F66AF42F38207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSWDM.EXE

Path C:\Windows\MSWDM.EXE
Size 4.0MB
SHA256 766d2557500c980d3f3589eba9e60e6200869e32ee474b43617b546b4c2db3ff
MD5 e346d9382546c4d723c06a383376b75e
SHA1 ce3c45f474284e89f5d4606ebe75dac7a4596d31
SHA512 6300c1b3d79967e607ecd11002487145266d8be1445904a71affcee533e11f824b5bb49ac629b040f507109970a3ab4aa17a493e87794496ec3a4bd266dd38b6
SSDEEP 49152:5yU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPBq/UybpuY:5yUgTH2M2m9UMpu1QfLczqsU
TLSH
T1AC16B512655A2F6CD15FD474CB4B8915AA237C8A0F356BEF0281AD713E76AF42F38207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dev527B.tmp

Path C:\Windows\dev527B.tmp
Size 794KB
SHA256 2435e1e50c097608e6157efb1036946cfdd02d86728e8e00a02b207bee36e60d
MD5 c6d0721e9156eb2a40a04bb38be0b2a5
SHA1 d0a3fcb3ad9f227a02d30abb767883b42fecc3a7
SHA512 e254db10a7cffc4fe8c2d126dc4eb5029a84b2a931a67ad9ebfd04a8f3417e42a7dfb2e76d8911b2540bcf9eff9cbf92708b158dd8f53dbcbe7be51682ac3ad4
SSDEEP 24576:F3LutmkEz+PAVV/OOInO4Xs2ztR4iegxLHgZpJE4VDd+:FbutmkO+wAOInO4XrztygxLHkJE4VB
TLSH
T1A505D022F3D0A536D7631331993A7231BBBE66301A128B136B541F957FA61E16F2C363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1640-28-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4528-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4528-11-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4544-22-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4688-25-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4976-27-0x0000000000400000-0x0000000000414000-memory.dmp

Download