d92bb6dab05dc735c5ea6597c9bbb15dfb7778ebcfe0ebbf6ad399debdeec626

Analysis

max time kernel
16s
max time network
91s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 09:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-16_bc0d8624bb6f702fd5a1240b541480f3_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_luca.exe
Size 9.0MB
Sample260916-lft3esad49
SHA256 d92bb6dab05dc735c5ea6597c9bbb15dfb7778ebcfe0ebbf6ad399debdeec626
MD5 bc0d8624bb6f702fd5a1240b541480f3
SHA1 97237c36fd38a6515deff4a99d9c8be1f1463a76
SHA512 ed98aa7e6192870b77cf62bf5374ce80cd6d25090432d5cc6c2638000a3c3d2862e9ec39ceabe7208a50810ddb283a5a66c7da6aed0b15bd688ed38a1416dfb0
SSDEEP 98304:ktzUgTH2M2m9UMpu1QfLczqssnKSS6MSui+w32+QDENms2n:JgTH2qBpu1QfLIqsufSgui+LjEN2
TLSH
T10C96281162D99FECC05FA034CE4A75B566237C458F21AFDF19847E293E726A06E3821F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence

Malware Config

Signatures

Detects executables packed with ASPack 8 IoCs

resource	yara_rule
behavioral2/memory/5592-0-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c5bd-4.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5592-9-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4760-16-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2524-18-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c5bf-17.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1408-20-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4796-21-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 5 IoCs

pid	Process
4796	MSWDM.EXE
2524	MSWDM.EXE
5112	2026-09-16_BC0D8624BB6F702FD5A1240B541480F3_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_IPAMOR_LUCA.EXE
4760	MSWDM.EXE
1408	MSWDM.EXE

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	2026-09-16_bc0d8624bb6f702fd5a1240b541480f3_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_luca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	2026-09-16_bc0d8624bb6f702fd5a1240b541480f3_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_luca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\MSWDM.EXE	2026-09-16_bc0d8624bb6f702fd5a1240b541480f3_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_luca.exe
File opened for modification	C:\Windows\dev4A7C.tmp	2026-09-16_bc0d8624bb6f702fd5a1240b541480f3_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_luca.exe
File opened for modification	C:\Windows\dev4A7C.tmp	MSWDM.EXE

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-16_bc0d8624bb6f702fd5a1240b541480f3_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_luca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-16_BC0D8624BB6F702FD5A1240B541480F3_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_IPAMOR_LUCA.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2524	MSWDM.EXE
2524	MSWDM.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5592 wrote to memory of 4796	5592	2026-09-16_bc0d8624bb6f702fd5a1240b541480f3_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_luca.exe	88
PID 5592 wrote to memory of 2524	5592	2026-09-16_bc0d8624bb6f702fd5a1240b541480f3_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_luca.exe	89
PID 2524 wrote to memory of 5112	2524	MSWDM.EXE	90
PID 2524 wrote to memory of 4760	2524	MSWDM.EXE	92

C:\Users\Admin\AppData\Local\Temp\2026-09-16_bc0d8624bb6f702fd5a1240b541480f3_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_luca.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-16_bc0d8624bb6f702fd5a1240b541480f3_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_luca.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5592
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4796
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\dev4A7C.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-16_bc0d8624bb6f702fd5a1240b541480f3_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_luca.exe! !
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2524
- - C:\Users\Admin\AppData\Local\Temp\2026-09-16_BC0D8624BB6F702FD5A1240B541480F3_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_IPAMOR_LUCA.EXE
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5112
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\dev4A7C.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-16_BC0D8624BB6F702FD5A1240B541480F3_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_IPAMOR_LUCA.EXE!
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4760

C:\Windows\MSWDM.EXE
MSWDM.EXE
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-09-16_BC0D8624BB6F702FD5A1240B541480F3_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_IPAMOR_LUCA.EXE

Path C:\Users\Admin\AppData\Local\Temp\2026-09-16_BC0D8624BB6F702FD5A1240B541480F3_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_IPAMOR_LUCA.EXE
Size 9.0MB
SHA256 a8ad1bae03418fedf563fa26fcbc9281e75da88d24efa2c9921f317f711dfaa2
MD5 0bac62a1083d975e9c5b420322130184
SHA1 edb603aa5b3b4d87963fa9fd821e729106f013ed
SHA512 41742e414b72451dd6239333c099f6032a0bf6885842b4a1191ff0e51385a692f35b59b22a2343562d44fceef0165963322555fe02562619bf1eb15666a01fc2
SSDEEP 98304:ktzUgTH2M2m9UMpu1QfLczqssnKSS6MSui+w32+QDENms2y:JgTH2qBpu1QfLIqsufSgui+LjENr
TLSH
T11C96281162D99FECC05FA034CE4A75B566237C458F21AFDF19847E293E726A06E3821F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-09-16_bc0d8624bb6f702fd5a1240b541480f3_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_luca.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-09-16_bc0d8624bb6f702fd5a1240b541480f3_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_luca.exe
Size 9.0MB
SHA256 7fac6f71a94dea86394059634c50a16cd39a57878f3c5539a191a156f0f8eba8
MD5 bc226964a0977010fdc9849d9aaf2086
SHA1 3834147de0fa84192c681727382aa979bac28af9
SHA512 4705c5d64f6fdc53a388a830b85ee0e3b20a3c5a1684e4b6ed60718131a671cf99e5c1287bcf76348edab08da030f20a9b267fc2b955cbac1e5afac852c14801
SSDEEP 98304:HgTH2M2m9UMpu1QfLczqssnKSS6MSui+w32+QDENms2y:HgTH2qBpu1QfLIqsufSgui+LjENr
TLSH
T16D96382172D99FE9C05FA130CE4A76A46633BC418F219FDF19447E293E762A05E3921F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSWDM.EXE

Path C:\Windows\MSWDM.EXE
Size 6.2MB
SHA256 0938fe02773aa8e750219b8c611b67cf1698facae6c93e97b3f9e68ca59ceff4
MD5 8ec7babb3f2fdda90d528613f91a047d
SHA1 90077c5305914876210ee7117c5f418088708bca
SHA512 2237374b80c253b108b1e506a2fa5be0833d32752e2dd146ef605b66c92e8e02623d4524716d0ee8b08ecaba354ad93d1ec73851a89dfc6841e2eef7b64513cc
SSDEEP 49152:ktzU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPBq/Uybp6:ktzUgTH2M2m9UMpu1QfLczqssnKSS6M9
TLSH
T1A766D61161DA9FDCC05FE474CE0665A166237C468F61AFDF1980BE293E766B06E3820F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dev4A7C.tmp

Path C:\Windows\dev4A7C.tmp
Size 2.7MB
SHA256 20b1b637692a87fd194d457ec0ffe33c351363600c926c9ebd2455ad98a566c9
MD5 ce9bb918cf467639704c6c1352006ab0
SHA1 0031fc5e096629078a2bcfeeae2ee6dcb7e64f82
SHA512 c8500870c0318e00bc68ac97adbf318310e61d8f6135a97e52075d8c0b04c86a133ab076c740364191d432e1aba5588df59202abeec0527ad8e30f40750ad38a
SSDEEP 49152:l3BKBUvdWJTy4uia5w32OvfZcvkuRdLHkJEANmsvHHu34:Iui+w32+QDENms2I
TLSH
T18FD5AE2173D4D137D092A330CFEDB27877BBBA108566D31B251D2A6A78B13904F5A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1408-20-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2524-18-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4760-16-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4796-21-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5592-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5592-9-0x0000000000400000-0x0000000000414000-memory.dmp

Download