6fb69962b51b8760a54dbca3c672a69d1c323a40dcf24f9641ab5493f9ccfd28

Analysis

max time kernel
18s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 14:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_f4e1fc3bb32c02d9b2f7370d6afffe1b_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_luca.exe
Size 11.9MB
Sample260930-sb4jmaag77
SHA256 6fb69962b51b8760a54dbca3c672a69d1c323a40dcf24f9641ab5493f9ccfd28
MD5 f4e1fc3bb32c02d9b2f7370d6afffe1b
SHA1 f0438fe05233dd4c3449e70faad71b814fbd22a1
SHA512 92d47713e90346fcb05927dc390632f538509527ae88f9b70bebfee34c1e52dd0d397041ca1e3bc2a3f260f97a2a0db8216737059029959aee389afda5944754
SSDEEP 196608:DgTH2qBpu1QfLIqsufSrgTH2qBpu1QfLIqsufM:cTHNBpu1Qfc09THNBpu1Qfc0M
TLSH
T184C6C41165DA9FDCC05FE474CE0669A16A237C468F61AFDF0980BE293E756B06E3810F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence

Malware Config

Signatures

Detects executables packed with ASPack 8 IoCs

resource	yara_rule
behavioral2/memory/4928-0-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c588-4.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4928-10-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5076-17-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c58a-18.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2984-19-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3748-20-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5912-21-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 5 IoCs

pid	Process
3748	MSWDM.EXE
2984	MSWDM.EXE
4580	2026-09-29_F4E1FC3BB32C02D9B2F7370D6AFFFE1B_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_IPAMOR_LUCA.EXE
5076	MSWDM.EXE
5912	MSWDM.EXE

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	2026-09-29_f4e1fc3bb32c02d9b2f7370d6afffe1b_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_luca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	2026-09-29_f4e1fc3bb32c02d9b2f7370d6afffe1b_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_luca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	MSWDM.EXE
\??\F:\	MSWDM.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\MSWDM.EXE	2026-09-29_f4e1fc3bb32c02d9b2f7370d6afffe1b_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_luca.exe
File opened for modification	C:\Windows\dev793.tmp	2026-09-29_f4e1fc3bb32c02d9b2f7370d6afffe1b_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_luca.exe
File opened for modification	C:\Windows\dev793.tmp	MSWDM.EXE

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MSWDM.EXE

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_f4e1fc3bb32c02d9b2f7370d6afffe1b_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_luca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2984	MSWDM.EXE
2984	MSWDM.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 3748	4928	2026-09-29_f4e1fc3bb32c02d9b2f7370d6afffe1b_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_luca.exe	88
PID 4928 wrote to memory of 2984	4928	2026-09-29_f4e1fc3bb32c02d9b2f7370d6afffe1b_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_luca.exe	89
PID 2984 wrote to memory of 5076	2984	MSWDM.EXE	92

C:\Users\Admin\AppData\Local\Temp\2026-09-29_f4e1fc3bb32c02d9b2f7370d6afffe1b_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_luca.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_f4e1fc3bb32c02d9b2f7370d6afffe1b_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_luca.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4928
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3748
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\dev793.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-29_f4e1fc3bb32c02d9b2f7370d6afffe1b_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_luca.exe! !
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Users\Admin\AppData\Local\Temp\2026-09-29_F4E1FC3BB32C02D9B2F7370D6AFFFE1B_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_IPAMOR_LUCA.EXE
    3⤵
    - Executes dropped EXE
    PID:4580
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\dev793.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-29_F4E1FC3BB32C02D9B2F7370D6AFFFE1B_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_IPAMOR_LUCA.EXE!
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:5076

C:\Windows\MSWDM.EXE
MSWDM.EXE
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:5912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-09-29_F4E1FC3BB32C02D9B2F7370D6AFFFE1B_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_IPAMOR_LUCA.EXE

Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_F4E1FC3BB32C02D9B2F7370D6AFFFE1B_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_IPAMOR_LUCA.EXE
Size 11.9MB
SHA256 74ad51f4ef45181cd17de92d3bd9ef13dbc092b581c0e3e20132ad62f25817f4
MD5 4ed2a0da1a06c17d92036051b367fa89
SHA1 90c5df5e17c4ccea84a29b68cf6176db7665db7e
SHA512 5158b3346bbca889fee473ea6869da9fd1cdf549ee19ea3ac3e30fe9c39b83a844d114f5418dedca7ad8e74d21b1d88e3d01c0bddf131c9b92263381661bdc5d
SSDEEP 196608:DgTH2qBpu1QfLIqsufSrgTH2qBpu1QfLIqsuf7:cTHNBpu1Qfc09THNBpu1Qfc07
TLSH
T17DC6C41165DA9FDCC05FE474CE0669A16A237C468F61AFDF0980BE293E756B06E3810F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-09-29_f4e1fc3bb32c02d9b2f7370d6afffe1b_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_luca.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_f4e1fc3bb32c02d9b2f7370d6afffe1b_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_luca.exe
Size 11.9MB
SHA256 136ed89c7127dccc8f2393e33b3e7e5d9707f888cd00db2aaaa9989905d6d1dd
MD5 55785d1d9c4453fe617c57ab761e131b
SHA1 644d1d9b9ea807cecc134129405eb0aa9c5c8773
SHA512 c21af933c9a3b479b9f9dce3fd756dde6951b2e2a9366a1a7c4412c9c62099a4e545ca79cac8f8cf5c93bbed5bf48bda9f366bb2d72698a6c34cf56367bb70ac
SSDEEP 196608:lgTH2qBpu1QfLIqsufSrgTH2qBpu1QfLIqsuf7:CTHNBpu1Qfc09THNBpu1Qfc07
TLSH
T168C6B41165DA9FDCC05FE474CE0669A16A237C868F61AFDF0980BE253E756B06E3810F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSWDM.EXE

Path C:\Windows\MSWDM.EXE
Size 6.2MB
SHA256 1493a85f8be9d1cdca3e1db7100b9aab8413709e6d9c419189060cc7d68b59f2
MD5 2128445a1d13ed41cb5f8892f2ca5070
SHA1 a1342c217e94d14df08d3218667a29802c4e7f01
SHA512 8be12875d53603e280f50975f79a11653871fd0e0f26ece03784e69eebc78ecc0daa250bc429f5b32c2eb832f9f2d475c9607eb77c2feeb4e1326a24979d2a14
SSDEEP 49152:kthU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPBq/Uybp6:kthUgTH2M2m9UMpu1QfLczqssnKSS6M9
TLSH
T19C66C51161DA9FDCC05FE474CE0665A166237C468F61AFDF1980BE293E766B06E3820F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dev793.tmp

Path C:\Windows\dev793.tmp
Size 5.7MB
SHA256 f5ee36de8edf9be2ac2752b219cfdcb7ca1677071b8e116cb876306e9f1b6628
MD5 ba18e99b3e17adb5b029eaebc457dd89
SHA1 ec0458f3c00d35b323f08d4e1cc2e72899429c38
SHA512 1f41929e6f5b555b60c411c7810cbf14e3af26100df5ac4533ec3739a278c1b925687284660efb4868e3741305098e2737836229efc9fe46c97a6057c10e677c
SSDEEP 49152:BPv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPBJ:NKUgTH2M2m9UMpu1QfLczqssnKSk
TLSH
T1D356B31165DA9FDCC05FA474CE0669A16A237C868F61AFDF0980BE253E756B06F3810F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2984-19-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3748-20-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4928-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4928-10-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5076-17-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5912-21-0x0000000000400000-0x0000000000414000-memory.dmp

Download