35dfc2793787e6f80c009a6f65ef44a026708cd324673fbf3b493d5a16d38012

Analysis

max time kernel
14s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-16_5cc0297a8f2852706d727d1be04f8aef_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_luca.exe
Size 6.6MB
Sample260916-phex3abj4x
SHA256 35dfc2793787e6f80c009a6f65ef44a026708cd324673fbf3b493d5a16d38012
MD5 5cc0297a8f2852706d727d1be04f8aef
SHA1 2fd4994d18481cf1b77cdaaa8d6166f90d6845c9
SHA512 f451554f14a96dd9ea1c9ecd0deabfd93ca7fb7e3724b23ad109815137d1b6d7008add09de3353f022802645684c42e35c85a45684f59fa3d0aec999c79a9345
SSDEEP 98304:ktzUgTH2M2m9UMpu1QfLczqssnKSS6MArOO53F:JgTH2qBpu1QfLIqsufS+D53F
TLSH
T1FC66E61162DA9FDCC05FE474CE0665A166237C458F61AFDF1980BE293E766B06E3820F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence

Malware Config

Signatures

Detects executables packed with ASPack 8 IoCs

resource	yara_rule
behavioral2/memory/4088-0-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c590-4.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4088-10-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4064-17-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1736-27-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c592-28.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5728-29-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2636-30-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 4 IoCs

pid	Process
2636	MSWDM.EXE
5728	MSWDM.EXE
1676	2026-09-16_5CC0297A8F2852706D727D1BE04F8AEF_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_IPAMOR_LUCA.EXE
4064	MSWDM.EXE

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	2026-09-16_5cc0297a8f2852706d727d1be04f8aef_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_luca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	2026-09-16_5cc0297a8f2852706d727d1be04f8aef_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_luca.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\MSWDM.EXE	2026-09-16_5cc0297a8f2852706d727d1be04f8aef_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_luca.exe
File opened for modification	C:\Windows\dev136F.tmp	2026-09-16_5cc0297a8f2852706d727d1be04f8aef_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_luca.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-16_5cc0297a8f2852706d727d1be04f8aef_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_luca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-16_5CC0297A8F2852706D727D1BE04F8AEF_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_IPAMOR_LUCA.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5728	MSWDM.EXE
5728	MSWDM.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 2636	4088	2026-09-16_5cc0297a8f2852706d727d1be04f8aef_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_luca.exe	87
PID 4088 wrote to memory of 5728	4088	2026-09-16_5cc0297a8f2852706d727d1be04f8aef_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_luca.exe	88
PID 5728 wrote to memory of 1676	5728	MSWDM.EXE	89

C:\Users\Admin\AppData\Local\Temp\2026-09-16_5cc0297a8f2852706d727d1be04f8aef_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_luca.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-16_5cc0297a8f2852706d727d1be04f8aef_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_luca.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4088
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2636
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\dev136F.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-16_5cc0297a8f2852706d727d1be04f8aef_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_luca.exe! !
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5728
- - C:\Users\Admin\AppData\Local\Temp\2026-09-16_5CC0297A8F2852706D727D1BE04F8AEF_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_IPAMOR_LUCA.EXE
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1676
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\dev136F.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-16_5CC0297A8F2852706D727D1BE04F8AEF_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_IPAMOR_LUCA.EXE!
    3⤵
    PID:1736

C:\Windows\MSWDM.EXE
MSWDM.EXE
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-09-16_5CC0297A8F2852706D727D1BE04F8AEF_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_IPAMOR_LUCA.EXE

Path C:\Users\Admin\AppData\Local\Temp\2026-09-16_5CC0297A8F2852706D727D1BE04F8AEF_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_IPAMOR_LUCA.EXE
Size 6.6MB
SHA256 7b5c32d9113617456f00f04684b0582ebd05cfe005c314ae71bed800d5966cdc
MD5 480918ba97ad9432bac444a1b4da0c48
SHA1 d5557aa28e88942281c74f855095f4ab96607bd3
SHA512 9fbc6f39d291a746b0a47047d6f751df469601350c5170a8c341cd00623f7cb13f7108bdacb3bbe389468d99d41a46872bebb0d62f657fc08aaaddc75b249bd1
SSDEEP 98304:ktzUgTH2M2m9UMpu1QfLczqssnKSS6MArOO53r:JgTH2qBpu1QfLIqsufS+D53r
TLSH
T19266E61162DA9FDCC05FE474CE0665A166237C458F61AFDF1980BE293E766B06E3820F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSWDM.EXE

Path C:\Windows\MSWDM.EXE
Size 6.2MB
SHA256 0938fe02773aa8e750219b8c611b67cf1698facae6c93e97b3f9e68ca59ceff4
MD5 8ec7babb3f2fdda90d528613f91a047d
SHA1 90077c5305914876210ee7117c5f418088708bca
SHA512 2237374b80c253b108b1e506a2fa5be0833d32752e2dd146ef605b66c92e8e02623d4524716d0ee8b08ecaba354ad93d1ec73851a89dfc6841e2eef7b64513cc
SSDEEP 49152:ktzU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPBq/Uybp6:ktzUgTH2M2m9UMpu1QfLczqssnKSS6M9
TLSH
T1A766D61161DA9FDCC05FE474CE0665A166237C468F61AFDF1980BE293E766B06E3820F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dev136F.tmp

Path C:\Windows\dev136F.tmp
Size 326KB
SHA256 7a2be844d6c626ece443d59fe3045c3ac776ea116bae56a1eba4aa28f2266c7c
MD5 5b48f7ea6b9f7abf0e1461adc83d0e49
SHA1 3565a8f1b3ce3fc732362345cc7cd6996061aab2
SHA512 1c441da0f1fab94f2bc39f818fa1500bdc04bd9626333f051bd25128ea991f616132f23ed0d38df464c7119b48016033cb362a52d985b959a482df3222f2aa54
SSDEEP 6144:VEJ5rX6GgcmDsL0vrxFsoAhnOkyiz53aJWTBP0tFwMYPgLESjIxvO1DoG:ePrXOcmFFgOkyU532WTh0tFhfa3G
TLSH
T1F4649D02BB96C173C96302725996632DD6B9B5710F3183D7B3E86B0DDE702E19932B87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1736-27-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2636-30-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4064-17-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4088-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4088-10-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5728-29-0x0000000000400000-0x0000000000414000-memory.dmp

Download