2ca314ad0666bbccbf004328ee7e941c2bd12f3cea5b0ce88115436ac38264dc

Analysis

max time kernel
15s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/09/2026, 20:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-12_e18be8fedbd0cd90d6e30b6aa8138735_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe
Size 6.0MB
Sample260913-zagf2adn6v
SHA256 2ca314ad0666bbccbf004328ee7e941c2bd12f3cea5b0ce88115436ac38264dc
MD5 e18be8fedbd0cd90d6e30b6aa8138735
SHA1 fb526d0a7673a0f27187f9a411014e91760c6532
SHA512 e89acddc1851043a6d28e697d418ea902f2cdc2ec4bae0145fc92fdd63b6dfcee6248e31646154416e9a2716d7ec29ea0ea3224c6d24ede70f5af7f7b5aabb60
SSDEEP 49152:5AU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPBq/UybpuU:5AUgTH2M2m9UMpu1QfLczqssnKSLjmNs
TLSH
T13E56C41125DA9FDCC05FA474CE0669B16A237C468F61AFDF1980BE293E756B06E3810F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence

Malware Config

Signatures

Detects executables packed with ASPack 8 IoCs

resource	yara_rule
behavioral2/memory/424-0-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000016b4d-4.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/424-10-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/712-16-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000016cd0-27.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/6020-29-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2564-26-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/704-30-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x0004000000016b4d-4.dat	aspack_v212_v242
behavioral2/files/0x0004000000016cd0-27.dat	aspack_v212_v242

Executes dropped EXE 5 IoCs

pid	Process
704	MSWDM.EXE
6020	MSWDM.EXE
2760	2026-09-12_E18BE8FEDBD0CD90D6E30B6AA8138735_AKIRA_AMADEY_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_NJRA.EXE
712	MSWDM.EXE
2564	MSWDM.EXE

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	2026-09-12_e18be8fedbd0cd90d6e30b6aa8138735_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	2026-09-12_e18be8fedbd0cd90d6e30b6aa8138735_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\MSWDM.EXE	2026-09-12_e18be8fedbd0cd90d6e30b6aa8138735_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Windows\devBACA.tmp	2026-09-12_e18be8fedbd0cd90d6e30b6aa8138735_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Windows\devBACA.tmp	MSWDM.EXE

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-12_e18be8fedbd0cd90d6e30b6aa8138735_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-12_E18BE8FEDBD0CD90D6E30B6AA8138735_AKIRA_AMADEY_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_NJRA.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6020	MSWDM.EXE
6020	MSWDM.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 424 wrote to memory of 704	424	2026-09-12_e18be8fedbd0cd90d6e30b6aa8138735_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe	87
PID 424 wrote to memory of 6020	424	2026-09-12_e18be8fedbd0cd90d6e30b6aa8138735_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe	88
PID 6020 wrote to memory of 2760	6020	MSWDM.EXE	89
PID 6020 wrote to memory of 2564	6020	MSWDM.EXE	95

C:\Users\Admin\AppData\Local\Temp\2026-09-12_e18be8fedbd0cd90d6e30b6aa8138735_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-12_e18be8fedbd0cd90d6e30b6aa8138735_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:424
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:704
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\devBACA.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-12_e18be8fedbd0cd90d6e30b6aa8138735_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe! !
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:6020
- - C:\Users\Admin\AppData\Local\Temp\2026-09-12_E18BE8FEDBD0CD90D6E30B6AA8138735_AKIRA_AMADEY_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_NJRA.EXE
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2760
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\devBACA.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-12_E18BE8FEDBD0CD90D6E30B6AA8138735_AKIRA_AMADEY_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_NJRA.EXE!
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2564

C:\Windows\MSWDM.EXE
MSWDM.EXE
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-09-12_E18BE8FEDBD0CD90D6E30B6AA8138735_AKIRA_AMADEY_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_NJRA.EXE

Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_E18BE8FEDBD0CD90D6E30B6AA8138735_AKIRA_AMADEY_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_NJRA.EXE
Size 6.0MB
SHA256 6c705375924d60387d4f24c64a5d704035388a739bfb76d1a1c2e526d6066df7
MD5 03cfb4848d0118e304219122eb7fb208
SHA1 e8bb2afad038f5507472d4078a990ab20ade120f
SHA512 77a5ad93b868bcbfff40f3e0f344a20be4497bfad16f343476e71a7cfa4447e45975028ab2bb9501677e1c86a9820092555966189e4cd322c9793298d26f694f
SSDEEP 49152:5AU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPBq/UybpuN:5AUgTH2M2m9UMpu1QfLczqssnKSLjmNF
TLSH
T16E56C41125DA9FDCC05FA474CE0669B16A237C468F61AFDF1980BE293E756B06E3810F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSWDM.EXE

Path C:\Windows\MSWDM.EXE
Size 5.7MB
SHA256 bcfe9ff3ab842e905a0aef3a52c745d26bdf021b9dd19f8e71768d33027024d7
MD5 d03b14721523db3e9094a5a00b883118
SHA1 5969fbea8a9067e14e16e203fc5c54fc3b76a574
SHA512 4d989a44cd0787687408053ab147c285dd2a7d0c3b1d2f00db0726a576e434a3df5927757fe3c1500d3d5091cb160b146fa7dfacd1c91d0fa444fb0bf845b318
SSDEEP 49152:5AU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPBq/Uybpu/:5AUgTH2M2m9UMpu1QfLczqssnKSo
TLSH
T1C056B41125DA9FDCC05FA474CE0669B16A237C468F61AFDF1980BE293E756B06E3810F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

devBACA.tmp

Path C:\Windows\devBACA.tmp
Size 242KB
SHA256 7fa8a5f008cc2ba5cc6c6908286e3b555b7dc0d41d119ee7e7785596391d0f32
MD5 0d0e2d55e442273ed08c54a64a47cec7
SHA1 bb6e8432775c4f1e32d2c7475cd7b3b57671990d
SHA512 217a050c22bf60d1186df27a853f87ab8478eaf9236a974e41352f1df972d1a11005eddcf4ee31b51aa3a554f706eda52334035191b664fd1da42889b8027834
SSDEEP 6144:gVzJ0J7guO92P2jsIVi5CnYav1882nSYy:izj4UsIVi5CnYjQYy
TLSH
T149347C307650C033D56716348AFAC7BA893EF8765B6140C7A7E8DFBD7E242C14A3924A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/424-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/424-10-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/704-30-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/712-16-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2564-26-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/6020-29-0x0000000000400000-0x0000000000414000-memory.dmp

Download