a7744dd066288715680c4f924c45f10feb32b493c6b1614ee5be9d936cfc31c9

Analysis

max time kernel
14s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-16_624d214ba497950b47e65912323d1dd1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
Size 5.8MB
Sample260916-pcpkbaxyex
SHA256 a7744dd066288715680c4f924c45f10feb32b493c6b1614ee5be9d936cfc31c9
MD5 624d214ba497950b47e65912323d1dd1
SHA1 507c0a8007866c2fe572d209836fd13338ce9487
SHA512 552b3cd7d896cfa7a17082e1671530ed3bf88cdc141e2d9fcb19ccb1aac59c15754a4eb76b61d90725140c84ea723134bae9bb101811c681908e62386df7c7af
SSDEEP 49152:5asKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPBq/Uyb3:5fKUgTH2M2m9UMpu1QfLczqssnKSf
TLSH
T13956C41125DA9FDCC05FA474CE0669B16A237C868F61AFDF19807E293E756B06E3810F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence

Malware Config

Signatures

Detects executables packed with ASPack 8 IoCs

resource	yara_rule
behavioral2/memory/4384-0-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c463-4.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4384-11-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4344-21-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c465-19.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4672-18-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4168-24-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4716-25-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c463-4.dat	aspack_v212_v242
behavioral2/files/0x000d00000001c465-19.dat	aspack_v212_v242

Executes dropped EXE 5 IoCs

pid	Process
4716	MSWDM.EXE
4344	MSWDM.EXE
1736	2026-09-16_624D214BA497950B47E65912323D1DD1_AKIRA_AMADEY_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_NJRAT_REMCOS_VIDAR_WANNACRY.EXE
4672	MSWDM.EXE
4168	MSWDM.EXE

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	2026-09-16_624d214ba497950b47e65912323d1dd1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	2026-09-16_624d214ba497950b47e65912323d1dd1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\MSWDM.EXE	2026-09-16_624d214ba497950b47e65912323d1dd1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Windows\dev3F13.tmp	2026-09-16_624d214ba497950b47e65912323d1dd1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Windows\dev3F13.tmp	MSWDM.EXE

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-16_624d214ba497950b47e65912323d1dd1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4344	MSWDM.EXE
4344	MSWDM.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4384 wrote to memory of 4716	4384	2026-09-16_624d214ba497950b47e65912323d1dd1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe	87
PID 4384 wrote to memory of 4344	4384	2026-09-16_624d214ba497950b47e65912323d1dd1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe	88
PID 4344 wrote to memory of 1736	4344	MSWDM.EXE	89
PID 4344 wrote to memory of 4672	4344	MSWDM.EXE	91

C:\Users\Admin\AppData\Local\Temp\2026-09-16_624d214ba497950b47e65912323d1dd1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-16_624d214ba497950b47e65912323d1dd1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4384
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4716
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\dev3F13.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-16_624d214ba497950b47e65912323d1dd1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe! !
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Users\Admin\AppData\Local\Temp\2026-09-16_624D214BA497950B47E65912323D1DD1_AKIRA_AMADEY_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_NJRAT_REMCOS_VIDAR_WANNACRY.EXE
    3⤵
    - Executes dropped EXE
    PID:1736
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\dev3F13.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-16_624D214BA497950B47E65912323D1DD1_AKIRA_AMADEY_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_NJRAT_REMCOS_VIDAR_WANNACRY.EXE!
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4672

C:\Windows\MSWDM.EXE
MSWDM.EXE
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-09-16_624D214BA497950B47E65912323D1DD1_AKIRA_AMADEY_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_NJRAT_REMCOS_VIDAR_WANNACRY.EXE

Path C:\Users\Admin\AppData\Local\Temp\2026-09-16_624D214BA497950B47E65912323D1DD1_AKIRA_AMADEY_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_NJRAT_REMCOS_VIDAR_WANNACRY.EXE
Size 5.8MB
SHA256 d1fb5082c28a607c39c3fa66c837fc4c31c532c2daca24395f518396ad8290d3
MD5 654b83d12889aabeff96478b0a61bb38
SHA1 3ce34b97331ca15c80233544db8ca26cf989f2f2
SHA512 cc7272a7f10daa97d7339901791133421adaacf0cfba946c1e32d809967300ba61682c2f7796c2fb6a56596cc82c6c7fd1cc1936a4023bde1966acfd57610b49
SSDEEP 49152:5asKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPBq/Uybe:5fKUgTH2M2m9UMpu1QfLczqssnKSm
TLSH
T15F56C41125DA9FDCC05FA474CE0669B16A237C868F61AFDF19807E293E756B06E3810F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSWDM.EXE

Path C:\Windows\MSWDM.EXE
Size 5.8MB
SHA256 ff018ef3ba80b8ce18a6c44772abc611a90179cc09f9a5a172952d67a9742b61
MD5 6be0c57d1287616fe476436853071858
SHA1 36e3fcc32707603f4d1d10b3f8d673b4d720a214
SHA512 8e92a7c7a3309676569854425cc4d9bff754608fe77578833111aa8d44a303b17fb774fba908fbe9df7f81f865c007839e2135e050a52b2157f4b730048c979c
SSDEEP 49152:5asKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPBq/Uyb7:5fKUgTH2M2m9UMpu1QfLczqssnKST
TLSH
T16156B41125DA9FDCC05FA474CE0669B16A237C868F61AFDF19807E293E756B06E3810F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dev3F13.tmp

Path C:\Windows\dev3F13.tmp
Size 16KB
SHA256 604d44e2ae1d685936b86d54cc5ac3934b508f2d675f27f9db3a090326fe1278
MD5 41b215c642fa7f6637b60f09afc6175d
SHA1 823b1b0b3200aebad82ceaca0c6ef218b01f1845
SHA512 4b3d097c6b2422a3464aa53b76e98b23cb66ebba2b015cd2a734fee4c07007e8fa3671ccd1aab312305840e75d1bfbfcfdb89aed2bf13403d1b8a04aa5defbdc
SSDEEP 192:Y+agHi8/RTyJbofVBSnLZZO9SJE3VEakNIb/+WYfurh/Y4RSTpBjSebyaAqjkKiA:9taLZYSqVE6qWYfuFgVTpBjTeajCoM6
TLSH
T1F2724D01EFBCD42AE4CA5D7015F8EE537D38AB538B2052DF219AA5DC18A67D48E3431B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4168-24-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4344-21-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4384-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4384-11-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4672-18-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4716-25-0x0000000000400000-0x0000000000414000-memory.dmp

Download