6015f10f5f4b2d1190d7e7e39a7638e79944bf7c29232fc9708d77b76a656bdf

General

Target
2026-09-30_c00bca4a83924844f1fdc02b2291d039_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_njra.exe
Size 5.9MB
Sample260930-jy9jqa1aqa
SHA256 6015f10f5f4b2d1190d7e7e39a7638e79944bf7c29232fc9708d77b76a656bdf
MD5 c00bca4a83924844f1fdc02b2291d039
SHA1 6bf7a0136f2377b59fc34926368c5251b2c7a1cf
SHA512 a082f4f26480412cd8d1d8e802bba80dc79c70e6bfb589ec20b97e6029480df8c8a1628059dc91b2c406ef9660e17276e426acebb0b61d68f192d83cb239ffc2
SSDEEP 49152:p2mfYTOYKaPv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+C:p2NKUgTH2M2m9UMpu1QfLczqssnKSh
TLSH
T1AB56C41166DA9FDCC05FA474CE0669A56A237C868F21AFDF09807E253E756B06F3810F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
3844	MSWDM.EXE
3692	MSWDM.EXE
1660	2026-09-30_C00BCA4A83924844F1FDC02B2291D039_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_IPAMOR_NJRA.EXE
2024	MSWDM.EXE
4312	MSWDM.EXE

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	2026-09-30_c00bca4a83924844f1fdc02b2291d039_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_njra.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	2026-09-30_c00bca4a83924844f1fdc02b2291d039_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_njra.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	MSWDM.EXE
\??\F:\	MSWDM.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\MSWDM.EXE	2026-09-30_c00bca4a83924844f1fdc02b2291d039_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_njra.exe
File opened for modification	C:\Windows\devFD28.tmp	2026-09-30_c00bca4a83924844f1fdc02b2291d039_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_njra.exe
File opened for modification	C:\Windows\devFD28.tmp	MSWDM.EXE

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MSWDM.EXE

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_c00bca4a83924844f1fdc02b2291d039_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_njra.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3692	MSWDM.EXE
3692	MSWDM.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 3844	4796	2026-09-30_c00bca4a83924844f1fdc02b2291d039_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_njra.exe	89
PID 4796 wrote to memory of 3692	4796	2026-09-30_c00bca4a83924844f1fdc02b2291d039_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_njra.exe	90
PID 3692 wrote to memory of 2024	3692	MSWDM.EXE	92

C:\Users\Admin\AppData\Local\Temp\2026-09-30_c00bca4a83924844f1fdc02b2291d039_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_njra.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_c00bca4a83924844f1fdc02b2291d039_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_njra.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4796
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3844
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\devFD28.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-30_c00bca4a83924844f1fdc02b2291d039_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_njra.exe! !
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3692
- - C:\Users\Admin\AppData\Local\Temp\2026-09-30_C00BCA4A83924844F1FDC02B2291D039_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_IPAMOR_NJRA.EXE
    3⤵
    - Executes dropped EXE
    PID:1660
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\devFD28.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-30_C00BCA4A83924844F1FDC02B2291D039_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_IPAMOR_NJRA.EXE!
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2024

C:\Windows\MSWDM.EXE
MSWDM.EXE
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:4312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-09-30_c00bca4a83924844f1fdc02b2291d039_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_njra.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_c00bca4a83924844f1fdc02b2291d039_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_njra.exe
Size 5.9MB
SHA256 e3e69641b5c8f105124f90d2e8479cba3ebf00fb3acc32206a960b1b8b0494d5
MD5 836fd95fc93c68a9a3abcf7f4c68bff9
SHA1 425b455b886c6b2f95dbb1fd2740efeda0db4d6b
SHA512 980dddde0f30304ae9b853da7976054e9b5589adcec4f254014d5bc50cb1f412fc706f386809f788f51f4abfb3ff6793607c3875b4b86982bb1439bb7cd8ffda
SSDEEP 49152:p2mfYTOYKaPv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+S:p2NKUgTH2M2m9UMpu1QfLczqssnKSZ
TLSH
T1A256C41166DA9FDCC05FA474CE0669A56A237C868F21AFDF09807E253E756B06F3810F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-09-30_c00bca4a83924844f1fdc02b2291d039_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_njra.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_c00bca4a83924844f1fdc02b2291d039_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_njra.exe
Size 5.9MB
SHA256 ce87a36f77628a97d11c7f8a19beffb43142166e81e356d221369f493eea2ca8
MD5 6767f87844f42fb9f67d40b9327cb16c
SHA1 77e1cfeded4a5a021906b8c62c63a128a606eb5d
SHA512 5feaf3b183f4eaf39cccf8c3d14883464c83f9aec2c3d569ff70933c4c8767a6edefdfdf13b8458d8e3571c5b3749e0ca0eb96c5dfe34e7666e5e50ed7e4258a
SSDEEP 49152:HfYTOYKaPv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWJ:+KUgTH2M2m9UMpu1QfLczqssnKSZ
TLSH
T11756B41166DA9FDCC05FA474CE0669A56A237C868F21AFDF09807E253E756B06F3810F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSWDM.EXE

Path C:\Windows\MSWDM.EXE
Size 256KB
SHA256 b580e3621992cfcf6701b16d94ee759d935957c459d51a53672a893f9c199b83
MD5 16a243b85f60d6da5f8cf544c196f96f
SHA1 6963a9ab685755e8ac10d0d6c300ad8b7963f2ac
SHA512 7a1bb138b760bfced490c51d22a6838dd8947cd1038825514a96d340a437c7e7425e54334bf006062bf2c46282760bf019adcecfcd4e8842744db5c358f10d1a
SSDEEP 3072:WcX93xwq19gL2SjGojCJa70f5ADt4STBfsY5vXWqvuHcYnLzqP2o:WcNhJgX9z0f57STB0YRX8nW
TLSH
T1DF44B60057F84A19F6FA4F7E89B0851F6A62FC32AC22DE5E2110520AC476E47CDB3767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

devFD28.tmp

Path C:\Windows\devFD28.tmp
Size 5.7MB
SHA256 f5ee36de8edf9be2ac2752b219cfdcb7ca1677071b8e116cb876306e9f1b6628
MD5 ba18e99b3e17adb5b029eaebc457dd89
SHA1 ec0458f3c00d35b323f08d4e1cc2e72899429c38
SHA512 1f41929e6f5b555b60c411c7810cbf14e3af26100df5ac4533ec3739a278c1b925687284660efb4868e3741305098e2737836229efc9fe46c97a6057c10e677c
SSDEEP 49152:BPv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPBJ:NKUgTH2M2m9UMpu1QfLczqssnKSk
TLSH
T1D356B31165DA9FDCC05FA474CE0669A16A237C868F61AFDF0980BE253E756B06F3810F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3844-15-0x00000000005C0000-0x00000000005C6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads