72b041ab8a7b4232acdd0478bc5c563b50ec813aa96c0f6aa3cd8b08c5373104

Analysis

max time kernel
18s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 08:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-16_ebeba0332be3418d9be782db65709796_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe
Size 7.0MB
Sample260916-j3pecagr8s
SHA256 72b041ab8a7b4232acdd0478bc5c563b50ec813aa96c0f6aa3cd8b08c5373104
MD5 ebeba0332be3418d9be782db65709796
SHA1 682f3fb4687c31903b634b6ea492cbdb375bd226
SHA512 eb1c9a25b32e896addeb6a78773cc7fbb2eca4feba7efd86c66919bc45cad34656e8aa1538a13faa8f8dce54d6d773ed154139819e47dac67aed8807ef343de6
SSDEEP 98304:5MKUgTH2M2m9UMpu1QfLczqssnKSJfkZck6fM:58gTH2qBpu1QfLIqsufVPkaM
TLSH
T12876E71161D99FDCC05FD474CE4669A5AA237C468F209FDF0980BE293E766B06E3821F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence

Malware Config

Signatures

Detects executables packed with ASPack 8 IoCs

resource	yara_rule
behavioral2/memory/4860-0-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000016b39-7.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4860-11-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000016b3c-20.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2532-22-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5840-19-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4244-25-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3568-26-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x0005000000016b39-7.dat	aspack_v212_v242
behavioral2/files/0x0004000000016b3c-20.dat	aspack_v212_v242

Executes dropped EXE 5 IoCs

pid	Process
3568	MSWDM.EXE
2532	MSWDM.EXE
4236	2026-09-16_EBEBA0332BE3418D9BE782DB65709796_AKIRA_AMADEY_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_LUCA.EXE
5840	MSWDM.EXE
4244	MSWDM.EXE

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	2026-09-16_ebeba0332be3418d9be782db65709796_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	2026-09-16_ebeba0332be3418d9be782db65709796_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\MSWDM.EXE	2026-09-16_ebeba0332be3418d9be782db65709796_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe
File opened for modification	C:\Windows\dev3212.tmp	2026-09-16_ebeba0332be3418d9be782db65709796_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe
File opened for modification	C:\Windows\dev3212.tmp	MSWDM.EXE

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-16_EBEBA0332BE3418D9BE782DB65709796_AKIRA_AMADEY_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_LUCA.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-16_ebeba0332be3418d9be782db65709796_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2532	MSWDM.EXE
2532	MSWDM.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 3568	4860	2026-09-16_ebeba0332be3418d9be782db65709796_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe	88
PID 4860 wrote to memory of 2532	4860	2026-09-16_ebeba0332be3418d9be782db65709796_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe	89
PID 2532 wrote to memory of 4236	2532	MSWDM.EXE	90
PID 2532 wrote to memory of 5840	2532	MSWDM.EXE	93

C:\Users\Admin\AppData\Local\Temp\2026-09-16_ebeba0332be3418d9be782db65709796_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-16_ebeba0332be3418d9be782db65709796_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4860
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3568
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\dev3212.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-16_ebeba0332be3418d9be782db65709796_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe! !
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Users\Admin\AppData\Local\Temp\2026-09-16_EBEBA0332BE3418D9BE782DB65709796_AKIRA_AMADEY_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_LUCA.EXE
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4236
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\dev3212.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-16_EBEBA0332BE3418D9BE782DB65709796_AKIRA_AMADEY_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_LUCA.EXE!
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:5840

C:\Windows\MSWDM.EXE
MSWDM.EXE
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-09-16_EBEBA0332BE3418D9BE782DB65709796_AKIRA_AMADEY_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_LUCA.EXE

Path C:\Users\Admin\AppData\Local\Temp\2026-09-16_EBEBA0332BE3418D9BE782DB65709796_AKIRA_AMADEY_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_LUCA.EXE
Size 7.0MB
SHA256 8d0fc98ba72f85f22b5274601ae6a525bd9293302f0d6076cbd55bc576ee7305
MD5 5054960c54299fa4a5ea4e7074887389
SHA1 506e5a7ce29ac3abddde1b59d3b85b463db7c170
SHA512 ad3a9afb2194525d70cbf76a1ead3ad2b55e2e588765ecea3026d3329974281cfca40a3efdcf51119a915fb759a9e854330e46cfb7e7b85c98473c2507d23227
SSDEEP 98304:5MKUgTH2M2m9UMpu1QfLczqssnKSJfkZck6f8:58gTH2qBpu1QfLIqsufVPka8
TLSH
T12576E71161D99FDCC05FD474CE4669A5AA237C468F209FDF0980BE293E766B06E3821F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSWDM.EXE

Path C:\Windows\MSWDM.EXE
Size 6.8MB
SHA256 98879ed6fd41ff6b2479695d251587e2447ab4d4022be1d3c20b3092f7fbdf05
MD5 5d11eee7ef1d166346e670942cccc1e8
SHA1 3009da620df1808119246b27a5acbb85749959b8
SHA512 a5853991d3df9b3ab46502305dafaab500d248b471a57cefd79301291f4d2dddf45472a236d3b942377219fcdcc8d277b4e66808e098e7e7f45a088169ab98a6
SSDEEP 98304:5MKUgTH2M2m9UMpu1QfLczqssnKSJfkZck66:58gTH2qBpu1QfLIqsufVPkf
TLSH
T19E76E71161D99FDCC05FD474CE4669A5AA237C468F209FDF0980BE293E766B06E3821F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dev3212.tmp

Path C:\Windows\dev3212.tmp
Size 227KB
SHA256 dd6dcdca09d20e9a5b5fd4aa9bffdbea09893a4dbe1032028d75e7e167f57fa6
MD5 1258cb50d9c13d40cdde686337bd66fb
SHA1 6e86f01ec3dab71d7086cbd4924ccd06f3132f75
SHA512 9d4c9444e397db33acb52a1ae5fd4a132ee5923545babf1c978c9cd17327dc909ddbe21a435826a2203ea46068f11383c3d94331b37bb0424511c62c8894f4e0
SSDEEP 3072:rYeCH7McSqqJQjtuB1URTJp6L6Dx6VveMQgYI/L8zMp3cKAArDZz4N9GhbkUNEkr:7CnqJQYU68wee3pxyN90vE43
TLSH
T1C034AE2637C4C075E1A30772DCADD7206BBAF8609E71C21B77A49B5E1D316819E32B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2532-22-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3568-26-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4244-25-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4860-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4860-11-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5840-19-0x0000000000400000-0x0000000000414000-memory.dmp

Download