ec199f9636411b1d12c4de799b05556eefac4dd1219f281f93f3ef2d413554a9

Analysis

max time kernel
13s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 15:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_ead86949b754fd3302e233bf0ee3716c_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
Size 6.1MB
Sample260930-svrdeabe82
SHA256 ec199f9636411b1d12c4de799b05556eefac4dd1219f281f93f3ef2d413554a9
MD5 ead86949b754fd3302e233bf0ee3716c
SHA1 89a99b81ee28acacb61edc93d7150ad2bc90a0ad
SHA512 128e89dc95cb801cd21d4327902ac24fcabbbf8cdd64c4f7557d7438f61f455af4266efb6714013536c878194044ddb1f1e152f8e66b9e407491c867005a53da
SSDEEP 49152:m+U8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPBq/UybpuG:m+UgTH2M2m9UMpu1QfLczqssnKSsdy
TLSH
T13656D61165DA9FDCC05FE474CE0669A16A237C468F61AFDF09807E293E756B06E3820F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence

Malware Config

Signatures

Detects executables packed with ASPack 9 IoCs

resource	yara_rule
behavioral2/memory/3060-0-0x0000000000400000-0x0000000000417000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x001500000001c44b-7.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4592-11-0x0000000000400000-0x0000000000417000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5200-12-0x0000000000400000-0x0000000000417000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3060-10-0x0000000000400000-0x0000000000417000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1624-17-0x0000000000400000-0x0000000000417000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1624-19-0x0000000000400000-0x0000000000417000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5200-35-0x0000000000400000-0x0000000000417000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4592-34-0x0000000000400000-0x0000000000417000-memory.dmp	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x001500000001c44b-7.dat	aspack_v212_v242

Executes dropped EXE 4 IoCs

pid	Process
4592	MSWDM.EXE
5200	MSWDM.EXE
1108	2026-09-29_EAD86949B754FD3302E233BF0EE3716C_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_NJRAT_REMCOS_VIDAR.EXE
1624	MSWDM.EXE

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	2026-09-29_ead86949b754fd3302e233bf0ee3716c_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	2026-09-29_ead86949b754fd3302e233bf0ee3716c_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	MSWDM.EXE
\??\F:\	MSWDM.EXE

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\MSWDM.EXE	2026-09-29_ead86949b754fd3302e233bf0ee3716c_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\dev8DEE.tmp	2026-09-29_ead86949b754fd3302e233bf0ee3716c_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MSWDM.EXE

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_ead86949b754fd3302e233bf0ee3716c_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5200	MSWDM.EXE
5200	MSWDM.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 4592	3060	2026-09-29_ead86949b754fd3302e233bf0ee3716c_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe	88
PID 3060 wrote to memory of 5200	3060	2026-09-29_ead86949b754fd3302e233bf0ee3716c_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe	89
PID 5200 wrote to memory of 1108	5200	MSWDM.EXE	90

C:\Users\Admin\AppData\Local\Temp\2026-09-29_ead86949b754fd3302e233bf0ee3716c_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ead86949b754fd3302e233bf0ee3716c_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3060
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:4592
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\dev8DEE.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-29_ead86949b754fd3302e233bf0ee3716c_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe! !
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5200
- - C:\Users\Admin\AppData\Local\Temp\2026-09-29_EAD86949B754FD3302E233BF0EE3716C_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_NJRAT_REMCOS_VIDAR.EXE
    3⤵
    - Executes dropped EXE
    PID:1108

C:\Windows\MSWDM.EXE
MSWDM.EXE
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:1624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MSWDM.EXE

Path C:\Windows\MSWDM.EXE
Size 5.7MB
SHA256 adc1359a35edbe0934fab5c1b2a2e33ef6e85116c2de1f1ed1b46f0196cc753e
MD5 0a14252431a76d1b10c130a74df906d8
SHA1 ed7d141ebe9b61dc1e9ea889d00f03d4f6041f41
SHA512 1ddeefdef843c6e6ad9924c85b61bacbd3277c7d7a4a231f6492b731bdb09b236ba766ce5d3c8b307f248ae4836c2c9820cf5a5d405b0047cd9a19279a31bc94
SSDEEP 49152:m+U8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPBq/Uybpu6:m+UgTH2M2m9UMpu1QfLczqssnKSl
TLSH
T1A556B41165DA9FDCC05FA474CE0669B16A237C868F61AFDF09807E293E756B06E3810F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dev8DEE.tmp

Path C:\Windows\dev8DEE.tmp
Size 430KB
SHA256 5d96bbc4e5b726d87c7cf547f5fe98f8f05434ec2130bd60cbf5671fd3a7381b
MD5 ffca2fbcc7e4637f2acc0a8a3b0dbaaa
SHA1 3697f037e527a31c013a2ff3ee2f6c373e67a2a7
SHA512 3d9bb3641bdb7d89d30a7d552c8eca7355ab64e56d6d1657dbfe4f4f66c93ced1aa75ffb1fc0326f5e06310bad6e51c94d57e7ef74e9db215ac2c72da1a20faf
SSDEEP 12288:WD+k3HVJ5xDfp4D7/SAOZi+5v4+rcKfth:UJVJTt4D7/SAOZi+5v48cKf3
TLSH
T127947C16B7A405F5E177E23DCA624A11E9767C165B30E74E03AC826A0F237619E3EF31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1624-17-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/1624-19-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/3060-0-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/3060-10-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/4592-11-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/4592-34-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/5200-12-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/5200-35-0x0000000000400000-0x0000000000417000-memory.dmp

Download