8333842d18fb8af2c4c4816892d26961ba558163ce91637084f5867c45daa6e7

Analysis

max time kernel
16s
max time network
6s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 19:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_7489bb80be3c0ecbaeed7e187bf1948e_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
Size 6.6MB
Sample260930-x5s27ssbpg
SHA256 8333842d18fb8af2c4c4816892d26961ba558163ce91637084f5867c45daa6e7
MD5 7489bb80be3c0ecbaeed7e187bf1948e
SHA1 17c3fee35a742dd5e9324f6173bd4bab621f889a
SHA512 e4b7faff50f338097e6b1da5778e89b42e71df5145c0a55b78e9edc1eaa9c4049fd578e31d14e929e56531faf81c7e6bb728a22b1a3f059f7cf8527549f9c715
SSDEEP 98304:5yUgTH2M2m9UMpu1QfLczqssnKSWs+wE9XD8VB0:5dgTH2qBpu1QfLIqsufWV9z8c
TLSH
T1B366E51162DA9FDCC05FA474CE0669B16A237C468F61AFDF19807E293E756B06E3810F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence

Malware Config

Signatures

Detects executables packed with ASPack 8 IoCs

resource	yara_rule
behavioral2/memory/4884-0-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c628-4.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4884-10-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3984-25-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c62a-22.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4136-27-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3460-21-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2208-28-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c628-4.dat	aspack_v212_v242
behavioral2/files/0x000c00000001c62a-22.dat	aspack_v212_v242

Executes dropped EXE 5 IoCs

pid	Process
2208	MSWDM.EXE
3984	MSWDM.EXE
5468	2026-09-29_7489BB80BE3C0ECBAEED7E187BF1948E_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_NJRAT_REMCOS_VIDAR.EXE
3460	MSWDM.EXE
4136	MSWDM.EXE

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	2026-09-29_7489bb80be3c0ecbaeed7e187bf1948e_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	2026-09-29_7489bb80be3c0ecbaeed7e187bf1948e_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	MSWDM.EXE
\??\F:\	MSWDM.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\dev4AAB.tmp	2026-09-29_7489bb80be3c0ecbaeed7e187bf1948e_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\dev4AAB.tmp	MSWDM.EXE
File created	C:\WINDOWS\MSWDM.EXE	2026-09-29_7489bb80be3c0ecbaeed7e187bf1948e_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MSWDM.EXE

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_7489bb80be3c0ecbaeed7e187bf1948e_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_7489BB80BE3C0ECBAEED7E187BF1948E_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_NJRAT_REMCOS_VIDAR.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3984	MSWDM.EXE
3984	MSWDM.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 2208	4884	2026-09-29_7489bb80be3c0ecbaeed7e187bf1948e_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe	89
PID 4884 wrote to memory of 3984	4884	2026-09-29_7489bb80be3c0ecbaeed7e187bf1948e_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe	90
PID 3984 wrote to memory of 5468	3984	MSWDM.EXE	92
PID 3984 wrote to memory of 3460	3984	MSWDM.EXE	93

C:\Users\Admin\AppData\Local\Temp\2026-09-29_7489bb80be3c0ecbaeed7e187bf1948e_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_7489bb80be3c0ecbaeed7e187bf1948e_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4884
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:2208
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\dev4AAB.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-29_7489bb80be3c0ecbaeed7e187bf1948e_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe! !
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3984
- - C:\Users\Admin\AppData\Local\Temp\2026-09-29_7489BB80BE3C0ECBAEED7E187BF1948E_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_NJRAT_REMCOS_VIDAR.EXE
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5468
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\dev4AAB.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-29_7489BB80BE3C0ECBAEED7E187BF1948E_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_NJRAT_REMCOS_VIDAR.EXE!
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:3460

C:\Windows\MSWDM.EXE
MSWDM.EXE
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:4136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-09-29_7489BB80BE3C0ECBAEED7E187BF1948E_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_NJRAT_REMCOS_VIDAR.EXE

Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_7489BB80BE3C0ECBAEED7E187BF1948E_AKIRA_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_NJRAT_REMCOS_VIDAR.EXE
Size 6.6MB
SHA256 6874605ce3c2a5f8dd4ebb7d03430f526ec7d6e128a8edf7eeb33d14528104e6
MD5 45c7c6e3cf2c26d018c35dfde75b5273
SHA1 5a6b3c471d6b03ccd2ed009c7e45984c96bfd02e
SHA512 c5c992357eedc6fb94af4f705172a2c819426602c1aa7adca8a5a3133ad172a3fce29c590db6e67d23b32dedb9542277fb521f3175f90f2aee1236b5611e1322
SSDEEP 98304:5yUgTH2M2m9UMpu1QfLczqssnKSWs+wE9XD8VBL:5dgTH2qBpu1QfLIqsufWV9z8z
TLSH
T14866E51162DA9FDCC05FA474CE0669B16A237C468F61AFDF19807E293E756B06E3810F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-09-29_7489bb80be3c0ecbaeed7e187bf1948e_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_7489bb80be3c0ecbaeed7e187bf1948e_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
Size 6.6MB
SHA256 dab0366fc4118194a4d8a2b185b56381d63abd5ac453fd8882d61218d14b3a85
MD5 611d6233e9fdcdd2acbcedf301e9249e
SHA1 feaa3d248cf76ce203e73cdacb6aeffcf0c6e3d3
SHA512 c79aa399611ebc2ef0182ac4ca779da975c52650a13153e00b880e72bc171022a2e2173eedda56790540f2f9c9048a5cad7239d2937ff2a3d8574416e6eff36e
SSDEEP 98304:4s+wugTH2M2m9UMpu1QfLczqssnKSWs+wE9XD8VBL:4DgTH2qBpu1QfLIqsufWV9z8z
TLSH
T1D166071162DA9FECC15F9434CE0669A16A237C468F61AFDF19807E293E756B06F3810F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSWDM.EXE

Path C:\Windows\MSWDM.EXE
Size 5.8MB
SHA256 053dfabbb30f011cb6987d4817a0e895e5f3db071e4ba37d01a330246fb1143e
MD5 a69886fc248087955a056c9c23ffdf62
SHA1 662cda8c339c22f51ebf0ac3c22db834e84fa538
SHA512 043797644cc012c308f7a76ec70521d2d531d44168563f7d19bd4b2b4fd83deae7c3636cee11c4b447ee0f34a4a22b7810ba5a7cac0858318af06648f50942aa
SSDEEP 49152:5yU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPBq/Uybpuc:5yUgTH2M2m9UMpu1QfLczqssnKSN
TLSH
T1A056B41126DA9FDCC05FA474CE0669B16A237C468F61AFDF19807E293E756B06E3810F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dev4AAB.tmp

Path C:\Windows\dev4AAB.tmp
Size 794KB
SHA256 2435e1e50c097608e6157efb1036946cfdd02d86728e8e00a02b207bee36e60d
MD5 c6d0721e9156eb2a40a04bb38be0b2a5
SHA1 d0a3fcb3ad9f227a02d30abb767883b42fecc3a7
SHA512 e254db10a7cffc4fe8c2d126dc4eb5029a84b2a931a67ad9ebfd04a8f3417e42a7dfb2e76d8911b2540bcf9eff9cbf92708b158dd8f53dbcbe7be51682ac3ad4
SSDEEP 24576:F3LutmkEz+PAVV/OOInO4Xs2ztR4iegxLHgZpJE4VDd+:FbutmkO+wAOInO4XrztygxLHkJE4VB
TLSH
T1A505D022F3D0A536D7631331993A7231BBBE66301A128B136B541F957FA61E16F2C363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2208-28-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3460-21-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3984-25-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4136-27-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4884-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4884-10-0x0000000000400000-0x0000000000414000-memory.dmp

Download