edf08123a096da0ab7e3091803f1f4dd8c2341353668a098bc5cc43434f90b71

Analysis

max time kernel
15s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 08:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_b166ba44846dbb9bace311503f93f129_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_njra.exe
Size 11.4MB
Sample260930-kfnd7ssfkf
SHA256 edf08123a096da0ab7e3091803f1f4dd8c2341353668a098bc5cc43434f90b71
MD5 b166ba44846dbb9bace311503f93f129
SHA1 4026b3c97af9669c85a661447273620523beaa89
SHA512 5a7b73bd3b13534045d9263f60a9b28fae74c96aad3ee1de74348aaac99c76b191580b8739b6ca7279cca06e6bf912c49d286eb64decf9481a473450927f425b
SSDEEP 196608:DgTH2qBpu1QfLIqsufrgTH2qBpu1QfLIqsuff:cTHNBpu1Qfc0ETHNBpu1Qfc0f
TLSH
T167C6B41165DA9FDCC05FA474CE0669A16A237C868F61AFDF09807E293E756B06F3810F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence

Malware Config

Signatures

Detects executables packed with ASPack 8 IoCs

resource	yara_rule
behavioral2/memory/5276-0-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00040000000187c7-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5276-10-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000016b3c-13.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5824-19-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2288-17-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1056-20-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5368-21-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 5 IoCs

pid	Process
1056	MSWDM.EXE
5824	MSWDM.EXE
5368	MSWDM.EXE
4588	2026-09-30_B166BA44846DBB9BACE311503F93F129_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_IPAMOR_NJRA.EXE
2288	MSWDM.EXE

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	2026-09-30_b166ba44846dbb9bace311503f93f129_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_njra.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	2026-09-30_b166ba44846dbb9bace311503f93f129_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_njra.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	MSWDM.EXE
\??\F:\	MSWDM.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\MSWDM.EXE	2026-09-30_b166ba44846dbb9bace311503f93f129_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_njra.exe
File opened for modification	C:\Windows\dev911B.tmp	2026-09-30_b166ba44846dbb9bace311503f93f129_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_njra.exe
File opened for modification	C:\Windows\dev911B.tmp	MSWDM.EXE

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MSWDM.EXE

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_b166ba44846dbb9bace311503f93f129_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_njra.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5824	MSWDM.EXE
5824	MSWDM.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5276 wrote to memory of 1056	5276	2026-09-30_b166ba44846dbb9bace311503f93f129_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_njra.exe	90
PID 5276 wrote to memory of 5824	5276	2026-09-30_b166ba44846dbb9bace311503f93f129_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_njra.exe	91
PID 5824 wrote to memory of 2288	5824	MSWDM.EXE	94

C:\Users\Admin\AppData\Local\Temp\2026-09-30_b166ba44846dbb9bace311503f93f129_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_njra.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_b166ba44846dbb9bace311503f93f129_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_njra.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5276
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:1056
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\dev911B.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-30_b166ba44846dbb9bace311503f93f129_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_njra.exe! !
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5824
- - C:\Users\Admin\AppData\Local\Temp\2026-09-30_B166BA44846DBB9BACE311503F93F129_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_IPAMOR_NJRA.EXE
    3⤵
    - Executes dropped EXE
    PID:4588
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\dev911B.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-30_B166BA44846DBB9BACE311503F93F129_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_IPAMOR_NJRA.EXE!
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2288

C:\Windows\MSWDM.EXE
MSWDM.EXE
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:5368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-09-30_b166ba44846dbb9bace311503f93f129_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_njra.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_b166ba44846dbb9bace311503f93f129_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_njra.exe
Size 11.4MB
SHA256 f01bc6849a68086acee97468bed0b86c6fd26d0db6e7cbd932a1cf1512b22b47
MD5 45c8523b01eca02892b2d0a664b28f49
SHA1 a4a96765e48413ed59754eaf37da13209a4c5eed
SHA512 3e97e78b35514bd34a2aee286dcdcb1eb15c1b041390fd01bf390b42dfeb27c5553c036ce82890b21908bd222900586afea90ef3f4f0f39130d94a7af26e7e9c
SSDEEP 196608:DgTH2qBpu1QfLIqsufrgTH2qBpu1QfLIqsufN:cTHNBpu1Qfc0ETHNBpu1Qfc0N
TLSH
T123C6B41165DA9FDCC05FA474CE0669A16A237C868F61AFDF09807E293E756B06F3810F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSWDM.EXE

Path C:\Windows\MSWDM.EXE
Size 5.7MB
SHA256 ae506ae7a7943eaf2a472240d5e4e3349e1a7ae49e1761e31608a34e5f4cf2b1
MD5 cfd1ae204b5d48a76de6f1ded9bbb8d1
SHA1 8728471af49e06ea731d89cd802cdb64a8f862fa
SHA512 4f8cb9c1b675e8188bbd173f1d939e8d7c5c18d03651447c8f10183ebce82a96b711ca1b0aae71aed46dc97f4dc0557f8999b8d8cd38227aab4a1efafa9f4ff5
SSDEEP 49152:kthU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPBq/Uybp1:kthUgTH2M2m9UMpu1QfLczqssnKSP
TLSH
T13456A31125DA9FDCC05FA474CE0669E16A237C868F61AFDF19807E293E756B06E3810F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dev911B.tmp

Path C:\Windows\dev911B.tmp
Size 5.7MB
SHA256 f5ee36de8edf9be2ac2752b219cfdcb7ca1677071b8e116cb876306e9f1b6628
MD5 ba18e99b3e17adb5b029eaebc457dd89
SHA1 ec0458f3c00d35b323f08d4e1cc2e72899429c38
SHA512 1f41929e6f5b555b60c411c7810cbf14e3af26100df5ac4533ec3739a278c1b925687284660efb4868e3741305098e2737836229efc9fe46c97a6057c10e677c
SSDEEP 49152:BPv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPBJ:NKUgTH2M2m9UMpu1QfLczqssnKSk
TLSH
T1D356B31165DA9FDCC05FA474CE0669A16A237C868F61AFDF0980BE253E756B06F3810F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1056-20-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2288-17-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5276-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5276-10-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5368-21-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5824-19-0x0000000000400000-0x0000000000414000-memory.dmp

Download