b55e2cf4378eb1e55222321dd1dc8e90083045b7ee90b39b06b3ce10653e1b27

Analysis

max time kernel
12s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 23:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_21b990d54cf907a1b00f29ed188ec569_akira_amadey_cobalt-strike_elex_hijackloader_icedid_ipam.exe
Size 6.7MB
Sample260930-26xh8styft
SHA256 b55e2cf4378eb1e55222321dd1dc8e90083045b7ee90b39b06b3ce10653e1b27
MD5 21b990d54cf907a1b00f29ed188ec569
SHA1 e88a1d69304bd36ab22638b61cdcec255b127a89
SHA512 212d9dbeeb386244720295cf503d1f27b34db31bd001b776ad9341792b2f3e651d653126b2fe340df622393cc241a0fcc2d3a0fca8542263ba054cdcfbbf7cbb
SSDEEP 98304:ktxUgTH2M2m9UMpu1QfLczqssnKSS6MK6A:bgTH2qBpu1QfLIqsufSE6A
TLSH
T1E666E71162D99FDCC05FE474CE4665A16A237C458F21AFDF0980BE293E766B06E3821F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence

Malware Config

Signatures

Detects executables packed with ASPack 8 IoCs

resource	yara_rule
behavioral2/memory/3892-0-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x001000000001c515-6.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3892-11-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2524-18-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4512-16-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c517-17.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1800-20-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3124-21-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 5 IoCs

pid	Process
1800	MSWDM.EXE
2524	MSWDM.EXE
1624	2026-09-29_21B990D54CF907A1B00F29ED188EC569_AKIRA_AMADEY_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_IPAM.EXE
4512	MSWDM.EXE
3124	MSWDM.EXE

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	2026-09-29_21b990d54cf907a1b00f29ed188ec569_akira_amadey_cobalt-strike_elex_hijackloader_icedid_ipam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	2026-09-29_21b990d54cf907a1b00f29ed188ec569_akira_amadey_cobalt-strike_elex_hijackloader_icedid_ipam.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	MSWDM.EXE
\??\F:\	MSWDM.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\MSWDM.EXE	2026-09-29_21b990d54cf907a1b00f29ed188ec569_akira_amadey_cobalt-strike_elex_hijackloader_icedid_ipam.exe
File opened for modification	C:\Windows\devA742.tmp	2026-09-29_21b990d54cf907a1b00f29ed188ec569_akira_amadey_cobalt-strike_elex_hijackloader_icedid_ipam.exe
File opened for modification	C:\Windows\devA742.tmp	MSWDM.EXE

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MSWDM.EXE

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_21b990d54cf907a1b00f29ed188ec569_akira_amadey_cobalt-strike_elex_hijackloader_icedid_ipam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2524	MSWDM.EXE
2524	MSWDM.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3892 wrote to memory of 1800	3892	2026-09-29_21b990d54cf907a1b00f29ed188ec569_akira_amadey_cobalt-strike_elex_hijackloader_icedid_ipam.exe	88
PID 3892 wrote to memory of 2524	3892	2026-09-29_21b990d54cf907a1b00f29ed188ec569_akira_amadey_cobalt-strike_elex_hijackloader_icedid_ipam.exe	89
PID 2524 wrote to memory of 1624	2524	MSWDM.EXE	90
PID 2524 wrote to memory of 4512	2524	MSWDM.EXE	93

C:\Users\Admin\AppData\Local\Temp\2026-09-29_21b990d54cf907a1b00f29ed188ec569_akira_amadey_cobalt-strike_elex_hijackloader_icedid_ipam.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_21b990d54cf907a1b00f29ed188ec569_akira_amadey_cobalt-strike_elex_hijackloader_icedid_ipam.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3892
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:1800
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\devA742.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-29_21b990d54cf907a1b00f29ed188ec569_akira_amadey_cobalt-strike_elex_hijackloader_icedid_ipam.exe! !
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2524
- - C:\Users\Admin\AppData\Local\Temp\2026-09-29_21B990D54CF907A1B00F29ED188EC569_AKIRA_AMADEY_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_IPAM.EXE
    3⤵
    - Executes dropped EXE
    PID:1624
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\devA742.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-29_21B990D54CF907A1B00F29ED188EC569_AKIRA_AMADEY_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_IPAM.EXE!
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4512

C:\Windows\MSWDM.EXE
MSWDM.EXE
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:3124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-09-29_21B990D54CF907A1B00F29ED188EC569_AKIRA_AMADEY_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_IPAM.EXE

Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_21B990D54CF907A1B00F29ED188EC569_AKIRA_AMADEY_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_IPAM.EXE
Size 6.7MB
SHA256 06b85ea61cfc9297b8941a15d924917f584897b5d3ba97cc7b1da9e159b63cb7
MD5 c70d3298f62456b63a65fa37c6fea6f9
SHA1 a72aba1afc3dcbcc6a6f0ebc4e6924d7414e937c
SHA512 6d3a066908679eacb565fd9fcba7de0eee6b971fa94184a2ee485380311708691714828036bc5f841f8a3a6e51ba9b8a9f508390682727d8bc166e2803b5eee9
SSDEEP 98304:ktxUgTH2M2m9UMpu1QfLczqssnKSS6MK6a:bgTH2qBpu1QfLIqsufSE6a
TLSH
T19066E71162D99FDCC05FE474CE4665A16A237C458F21AFDF0980BE293E766B06E3821F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-09-29_21b990d54cf907a1b00f29ed188ec569_akira_amadey_cobalt-strike_elex_hijackloader_icedid_ipam.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_21b990d54cf907a1b00f29ed188ec569_akira_amadey_cobalt-strike_elex_hijackloader_icedid_ipam.exe
Size 6.7MB
SHA256 cb10bc80c834d51f60e513b9328fb244afd6349606cd03243d4e32fad5f1dd29
MD5 70aaae0611e78549855cf791e62fa0c6
SHA1 c7f80e0d1c1911b99b307718797518330b312411
SHA512 7be882c1ddf7aba1f533373caf53e81d26aca179b46e93d4cd175cb1b73a4efef81ade5f4f46ea95d064a14735129fc780e9132b8aaafadfb29c80a830fe5c1a
SSDEEP 98304:c6SgTH2M2m9UMpu1QfLczqssnKSS6MK6a:c6SgTH2qBpu1QfLIqsufSE6a
TLSH
T16E66E61162D98FDCC05FD474CE4665A5AA237C458F21AFDF0980BE293E766B06E3821F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSWDM.EXE

Path C:\Windows\MSWDM.EXE
Size 6.2MB
SHA256 e9f229e4d5357cae0b76da5e34a47cd6710f9b4c1b32b3ad9fb5b77be76d7902
MD5 1357c2068a992d49648407df12da225e
SHA1 3bf349117c90e5c60456e837cefbc4939401df63
SHA512 bb92330a3f324895534cf7ef75beb2cd9a128ab03972bc64f63b298101d1c53f3ce731a3bf73438dc0baaf014a3925e2cdfdcd7001e3e8200cb994f06cb37735
SSDEEP 49152:ktxU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPBq/Uybp6:ktxUgTH2M2m9UMpu1QfLczqssnKSS6M9
TLSH
T1C866D61161DA9FDCC05FE474CE0665A166237C468F61AFDF1980BE293E766B06E3820F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

devA742.tmp

Path C:\Windows\devA742.tmp
Size 458KB
SHA256 344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
MD5 619f7135621b50fd1900ff24aade1524
SHA1 6c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA512 2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
SSDEEP 6144:fz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktNP08NhKs39zo43fTtl1fayCV7+DHV:r1gL5pRTcAkS/3hzN8qE43fm78V
TLSH
T10BA40815F6748631D073D0BAC5D3AA9AEE3230855B308ACB1286D7782F277E6C936731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1800-20-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2524-18-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3124-21-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3892-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3892-11-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4512-16-0x0000000000400000-0x0000000000414000-memory.dmp

Download