40273ff106f2ed122fb6289e24975ef8bc03ea82e8cf593ecd296e3c4c90b2bd

Analysis

max time kernel
9s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 10:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_6d4ded408afbdb0af844447ebc5b6d83_akira_amadey_cobalt-strike_elex_hijackloader_icedid_ipam.exe
Size 6.2MB
Sample260930-mn5dsszgre
SHA256 40273ff106f2ed122fb6289e24975ef8bc03ea82e8cf593ecd296e3c4c90b2bd
MD5 6d4ded408afbdb0af844447ebc5b6d83
SHA1 3148d5ab66ebf7cb76e567278687fa4c8ceaddda
SHA512 741d6ac67d9f200e56a024e06469adca0cb1ce2ffde2c5a58b066b35482f5aeaff8c135cb84bb470941770a5bcb30566f9a8d16730b23cf503267899c3dbfcd5
SSDEEP 49152:ktVU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPBq/Uybpl:ktVUgTH2M2m9UMpu1QfLczqssnKS26h
TLSH
T1F456D51165DA9FDCC05FD474CE4669A16A237C468F20AFDF0980BE293E766B06E3811F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence

Malware Config

Signatures

Detects executables packed with ASPack 8 IoCs

resource	yara_rule
behavioral2/memory/3092-0-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3092-10-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000f00000001c44e-9.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5872-17-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c45c-16.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4684-15-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3000-19-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1896-20-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 4 IoCs

pid	Process
1896	MSWDM.EXE
5872	MSWDM.EXE
4684	MSWDM.EXE
3000	MSWDM.EXE

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	2026-09-30_6d4ded408afbdb0af844447ebc5b6d83_akira_amadey_cobalt-strike_elex_hijackloader_icedid_ipam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	2026-09-30_6d4ded408afbdb0af844447ebc5b6d83_akira_amadey_cobalt-strike_elex_hijackloader_icedid_ipam.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	MSWDM.EXE
\??\F:\	MSWDM.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\MSWDM.EXE	2026-09-30_6d4ded408afbdb0af844447ebc5b6d83_akira_amadey_cobalt-strike_elex_hijackloader_icedid_ipam.exe
File opened for modification	C:\Windows\dev2EC7.tmp	2026-09-30_6d4ded408afbdb0af844447ebc5b6d83_akira_amadey_cobalt-strike_elex_hijackloader_icedid_ipam.exe
File opened for modification	C:\Windows\dev2EC7.tmp	MSWDM.EXE

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MSWDM.EXE

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_6d4ded408afbdb0af844447ebc5b6d83_akira_amadey_cobalt-strike_elex_hijackloader_icedid_ipam.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5872	MSWDM.EXE
5872	MSWDM.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3092 wrote to memory of 1896	3092	2026-09-30_6d4ded408afbdb0af844447ebc5b6d83_akira_amadey_cobalt-strike_elex_hijackloader_icedid_ipam.exe	89
PID 3092 wrote to memory of 5872	3092	2026-09-30_6d4ded408afbdb0af844447ebc5b6d83_akira_amadey_cobalt-strike_elex_hijackloader_icedid_ipam.exe	90
PID 5872 wrote to memory of 4684	5872	MSWDM.EXE	91

C:\Users\Admin\AppData\Local\Temp\2026-09-30_6d4ded408afbdb0af844447ebc5b6d83_akira_amadey_cobalt-strike_elex_hijackloader_icedid_ipam.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_6d4ded408afbdb0af844447ebc5b6d83_akira_amadey_cobalt-strike_elex_hijackloader_icedid_ipam.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3092
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:1896
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\dev2EC7.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-30_6d4ded408afbdb0af844447ebc5b6d83_akira_amadey_cobalt-strike_elex_hijackloader_icedid_ipam.exe! !
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5872
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\dev2EC7.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-30_6D4DED408AFBDB0AF844447EBC5B6D83_AKIRA_AMADEY_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_IPAM.EXE!
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4684

C:\Windows\MSWDM.EXE
MSWDM.EXE
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:3000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-09-30_6D4DED408AFBDB0AF844447EBC5B6D83_AKIRA_AMADEY_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_IPAM.EXE

Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_6D4DED408AFBDB0AF844447EBC5B6D83_AKIRA_AMADEY_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_IPAM.EXE
Size 6.1MB
SHA256 610959ad69a2754cba8be26447a54cde7a91754dcd7c8b1f743a390e11430c29
MD5 7838f50327d5ae8fa8a5338421d59afc
SHA1 7032857c925ba596dfa1a7343016435ee2b9ddc2
SHA512 91656d72d4a2c38dc4e89d574295a4a320278b561cc0779900052bcc5c8702f9e0585fca73bfe7a4b18ba7e44bb0622849f6c79d71ff15a290097a0b626aa92f
SSDEEP 49152:ktaU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPBq/UybpU:ktaUgTH2M2m9UMpu1QfLczqssnKS264
TLSH
T1C056C51165DA9FDCC05FD474CE4669A16A237C468F20AFDF0980BE293E766B06E3811F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSWDM.EXE

Path C:\WINDOWS\MSWDM.EXE
Size 5.7MB
SHA256 e1057d64c08b68239ef90126fdbc54e89e631b0644884c0238acd40c1f824e48
MD5 cf02ef44eff5b91e8bad52a3d26e3fb4
SHA1 ed4b42ce32a7ec006f42cb607615ddc551d3247e
SHA512 1f416105c21ca9fd823f12f203d7de88cc8c9a392a403631005e9147451a45a9243e1215786056772ddd024da560bf33e16072662ae11fd7d37add2aa64b16a5
SSDEEP 49152:ktVU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPBq/Uybp1:ktVUgTH2M2m9UMpu1QfLczqssnKSP
TLSH
T18856B41125DA9FDCC05FA474CE0669A16A237C868F61AFDF19807E293E756B06E3810F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dev2EC7.tmp

Path C:\Windows\dev2EC7.tmp
Size 458KB
SHA256 d37e8e794f60ede3fff437a9613de636f9ec1cddbbcab2b2c4ce8914a5e67841
MD5 c670d9029c2bcc134c95a0e2646d0393
SHA1 0bdf42c22298e513554d7e9167bfda23e60dc790
SHA512 c654e54ea4f0607a2995cd00d14728b6c498451771fbd00c3dcd6dadf27b67def3cf10d97f44999336c7c55522e757a3ab7611cbb1c1053b35d495524a43e8cb
SSDEEP 6144:Bz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktNP08NhKs39zo43fTtl1fayCV7+DHX:J1gL5pRTcAkS/3hzN8qE43fm78X
TLSH
T1F0A40925F6748231D073D0B9C5D3A69AEE7230855B308ACB128AD7782F677E6C936731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1896-20-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3000-19-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3092-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3092-10-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4684-15-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5872-17-0x0000000000400000-0x0000000000414000-memory.dmp

Download