0e9395b1fe867ddbcef9e683f2da46652ef7fc7d985a507dad0d83fda724cd0b

Analysis

max time kernel
17s
max time network
5s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_db71ca0ea79e34e80752690e9157a390_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_njra.exe
Size 5.9MB
Sample260930-tkqjsszblb
SHA256 0e9395b1fe867ddbcef9e683f2da46652ef7fc7d985a507dad0d83fda724cd0b
MD5 db71ca0ea79e34e80752690e9157a390
SHA1 ad70d864d114a2e96e3685e4ea855bc3b810ce95
SHA512 4a9f9912970f35eb89ff60b225de806c1c194c44bc091218382f26e7037e10205cd66e3514a1e2b45b3e4d5b0ccc7723b15fdffc24d9ab47f11182754755b5cd
SSDEEP 49152:kt5Pv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTP:ktVKUgTH2M2m9UMpu1QfLczqssnKSc
TLSH
T1F756B41125DA9FDCC05FA474CE0669B16A237C868F61AFDF0980BE253E756B46E3810F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence

Malware Config

Signatures

Detects executables packed with ASPack 8 IoCs

resource	yara_rule
behavioral2/memory/5940-0-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c4cd-4.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5940-10-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c4d0-12.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4308-14-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2856-16-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4468-18-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2420-19-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 4 IoCs

pid	Process
2420	MSWDM.EXE
2856	MSWDM.EXE
4308	MSWDM.EXE
4468	MSWDM.EXE

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	2026-09-29_db71ca0ea79e34e80752690e9157a390_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_njra.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	2026-09-29_db71ca0ea79e34e80752690e9157a390_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_njra.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	MSWDM.EXE
\??\F:\	MSWDM.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\MSWDM.EXE	2026-09-29_db71ca0ea79e34e80752690e9157a390_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_njra.exe
File opened for modification	C:\Windows\dev15D0.tmp	2026-09-29_db71ca0ea79e34e80752690e9157a390_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_njra.exe
File opened for modification	C:\Windows\dev15D0.tmp	MSWDM.EXE

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MSWDM.EXE

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_db71ca0ea79e34e80752690e9157a390_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_njra.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2856	MSWDM.EXE
2856	MSWDM.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5940 wrote to memory of 2420	5940	2026-09-29_db71ca0ea79e34e80752690e9157a390_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_njra.exe	89
PID 5940 wrote to memory of 2856	5940	2026-09-29_db71ca0ea79e34e80752690e9157a390_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_njra.exe	90
PID 2856 wrote to memory of 4308	2856	MSWDM.EXE	91

C:\Users\Admin\AppData\Local\Temp\2026-09-29_db71ca0ea79e34e80752690e9157a390_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_njra.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_db71ca0ea79e34e80752690e9157a390_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_njra.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5940
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:2420
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\dev15D0.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-29_db71ca0ea79e34e80752690e9157a390_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_njra.exe! !
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\dev15D0.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-29_DB71CA0EA79E34E80752690E9157A390_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_IPAMOR_NJRA.EXE!
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4308

C:\Windows\MSWDM.EXE
MSWDM.EXE
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:4468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-09-29_db71ca0ea79e34e80752690e9157a390_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_njra.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_db71ca0ea79e34e80752690e9157a390_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_njra.exe
Size 5.9MB
SHA256 f43c2bd4d47e9c43c970f999dfaa6bfb7694019f681f3738b4621506324b1601
MD5 99024d602f85edda7ac2f635ea277c76
SHA1 32ac68134a7e265cf5787f7818545c88bb1e098c
SHA512 dd297f22b4239d6f629a88844084d641fcc7eea8ea768d134a62bc9a3df6fc3e0d073a5d0acb59b20d11ae90f962371c9c3bf105e5ca3941e8dc86694f464542
SSDEEP 49152:kt5Pv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTt:ktVKUgTH2M2m9UMpu1QfLczqssnKSS
TLSH
T1FA56B41125DA9FDCC05FA474CE0669B16A237C868F61AFDF0980BE253E756B46E3810F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSWDM.EXE

Path C:\Windows\MSWDM.EXE
Size 219KB
SHA256 c2363b6e3422c5883fbc8726d0824308ec8a4cc9a7631005e274c1cadb7126b5
MD5 394b61e4b42aae5797bbcdb5e59190ba
SHA1 5a7be17e80197047e8cbe9e9b4b53803f19d0e96
SHA512 6ae36a48d5a10f31c41b439c75b4712e9077815dc4601ce7e974e6183f969779288887f28df238f13a2848fda3442dd9975842f744ce650103e750d343c2a1f0
SSDEEP 1536:jmpLeICAsvW2++ijLR9pzvRojCJa71+nY:kLldsvWL+6V9pdojCJa7AnY
TLSH
T1C22492063680CF76C05F15B6D4B286F81767AE11CD04ABD7B6C8FE6A78B329E6D21143
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dev15D0.tmp

Path C:\Windows\dev15D0.tmp
Size 5.7MB
SHA256 9d26ca3a912b3edacf95e1add18765068f2239d3afc87226fb34c0e3db3890e5
MD5 3a6ccf22e45a76830ba20b32a312a1ed
SHA1 ea38df8aabf8dce31e46a2c9ea90d68ee9c7f372
SHA512 16da0898520de797130f42306e572290b17c76479d6b62bff88f9c413bfdf95cc4ec210ecda363ef6e3e89cde35075c9d410f95a3a877198bc1c9482476818be
SSDEEP 49152:qPv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPBJ:MKUgTH2M2m9UMpu1QfLczqssnKSk
TLSH
T12D56B41165DA9FDCC05FA474CE0669A16A237C868F61AFDF09807E293E756B06F3810F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2420-19-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2856-16-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4308-14-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4468-18-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5940-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5940-10-0x0000000000400000-0x0000000000414000-memory.dmp

Download