010e0553fc0bc35edfb36bbdf28c9820d84994c7c4f49b4b380e65fa3d1b43ad

Analysis

max time kernel
13s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-10_392f00ef6498a4b77fb6c904be673f96_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe
Size 7.2MB
Sample261011-va4jcadf49
SHA256 010e0553fc0bc35edfb36bbdf28c9820d84994c7c4f49b4b380e65fa3d1b43ad
MD5 392f00ef6498a4b77fb6c904be673f96
SHA1 3d7c19f393b4d982d0c9d6206320e889c97bc7a3
SHA512 e38ea04b4142d00a8d1517acd48a7aa842a71a4a969430cefd53f612921e8bd5e1a65e6ab12a1f6fa736067880f238c7c539b2438fa711f9da2579ddb55b2cb0
SSDEEP 98304:5HUgTH2M2m9UMpu1QfLczqssnKSu6nfkZc86c:50gTH2qBpu1QfLIqsufuIP86c
TLSH
T16876E61161E98FDCC06FD474CE4669A5AA237C468F209FDF0981BE293E766B05E3421F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence

Malware Config

Signatures

Detects executables packed with ASPack 8 IoCs

resource	yara_rule
behavioral2/memory/2368-0-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c465-4.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2368-9-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2396-16-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c467-13.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4584-19-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2416-22-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4704-23-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c465-4.dat	aspack_v212_v242
behavioral2/files/0x000d00000001c467-13.dat	aspack_v212_v242

Executes dropped EXE 5 IoCs

pid	Process
4704	MSWDM.EXE
4584	MSWDM.EXE
5000	2026-10-10_392F00EF6498A4B77FB6C904BE673F96_AKIRA_AMADEY_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_LUCA.EXE
2396	MSWDM.EXE
2416	MSWDM.EXE

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	2026-10-10_392f00ef6498a4b77fb6c904be673f96_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	2026-10-10_392f00ef6498a4b77fb6c904be673f96_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\MSWDM.EXE	2026-10-10_392f00ef6498a4b77fb6c904be673f96_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe
File opened for modification	C:\Windows\dev5133.tmp	2026-10-10_392f00ef6498a4b77fb6c904be673f96_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe
File opened for modification	C:\Windows\dev5133.tmp	MSWDM.EXE

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MSWDM.EXE

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-10_392f00ef6498a4b77fb6c904be673f96_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4584	MSWDM.EXE
4584	MSWDM.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 4704	2368	2026-10-10_392f00ef6498a4b77fb6c904be673f96_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe	90
PID 2368 wrote to memory of 4584	2368	2026-10-10_392f00ef6498a4b77fb6c904be673f96_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe	91
PID 4584 wrote to memory of 5000	4584	MSWDM.EXE	92
PID 4584 wrote to memory of 2396	4584	MSWDM.EXE	95

C:\Users\Admin\AppData\Local\Temp\2026-10-10_392f00ef6498a4b77fb6c904be673f96_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-10_392f00ef6498a4b77fb6c904be673f96_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2368
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:4704
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\dev5133.tmp!C:\Users\Admin\AppData\Local\Temp\2026-10-10_392f00ef6498a4b77fb6c904be673f96_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe! !
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4584
- - C:\Users\Admin\AppData\Local\Temp\2026-10-10_392F00EF6498A4B77FB6C904BE673F96_AKIRA_AMADEY_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_LUCA.EXE
    3⤵
    - Executes dropped EXE
    PID:5000
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\dev5133.tmp!C:\Users\Admin\AppData\Local\Temp\2026-10-10_392F00EF6498A4B77FB6C904BE673F96_AKIRA_AMADEY_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_LUCA.EXE!
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2396

C:\Windows\MSWDM.EXE
MSWDM.EXE
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:2416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-10-10_392f00ef6498a4b77fb6c904be673f96_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-10-10_392f00ef6498a4b77fb6c904be673f96_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe
Size 7.2MB
SHA256 eaf4b34a18195f0b48dd27002c3e8d08c8aab5d38f0f0a73ef099293d34d6b17
MD5 34d31ab5429a04f096161f89b49d109f
SHA1 092c8a1e50e0a155f2c0578190abc45898efede5
SHA512 41b1668e9f79a7b29d41fbb056a7fd3bf1e6058029fa52a7cd62f5ccbeb5592e3fdb3ed3435cadca613cd798ddd3661f3ee4956d7c2f41d355e432b3d6e33271
SSDEEP 98304:c6KgTH2M2m9UMpu1QfLczqssnKSu6nfkZc86V:c6KgTH2qBpu1QfLIqsufuIP86V
TLSH
T1DC76E71165E98FE9C06FD474CD466AA5A9333C458F209FDF0981BE293E366E09E3421F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-10-10_392f00ef6498a4b77fb6c904be673f96_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-10-10_392f00ef6498a4b77fb6c904be673f96_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe
Size 7.2MB
SHA256 ee5b8f36627f6e209549f7ec329217ec759da96fb07c43ff92b2c18230b4dbb9
MD5 2d7594ad534c22a15f110d4d10752e53
SHA1 bca56c76b3484d0bc5ce8e956e4485a8f99832a1
SHA512 a6a6c79a792897a1592fece40e3d0f00c87594c6767fc875f0e5f1c66116cc2b158403f9c970d8b2f29cf3e126ed6388edee0b560aac2a550bdd6385cf3ef625
SSDEEP 98304:5HUgTH2M2m9UMpu1QfLczqssnKSu6nfkZc86V:50gTH2qBpu1QfLIqsufuIP86V
TLSH
T1CD76E61161E98FDCC06FD474CE4669A5AA237C468F209FDF0981BE293E766B05E3421F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSWDM.EXE

Path C:\Windows\MSWDM.EXE
Size 6.8MB
SHA256 7f254492fcf90d6765b3d237af2fbb7acbe33c300b58a4b6b62024c6320b7ce1
MD5 be861f728cdf73cb9162df991be62e94
SHA1 781771e9c28de9c2c3b72aba17bad6c06bbc3af8
SHA512 0cddeb8acf59a0ba524fce7ddfcbac3005523bb3baf877fd689739663b676824a9ea5845466da465e0826774f11a9500876afd7a964d8c0c8768aa7f9b44c72a
SSDEEP 98304:5HUgTH2M2m9UMpu1QfLczqssnKSu6nfkZcH:50gTH2qBpu1QfLIqsufuIPH
TLSH
T1CB66E71161E98FDCC05FD474CE4669A5AA237C468F219FDF0980BE293E766B05E3821F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dev5133.tmp

Path C:\Windows\dev5133.tmp
Size 458KB
SHA256 344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
MD5 619f7135621b50fd1900ff24aade1524
SHA1 6c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA512 2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
SSDEEP 6144:fz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktNP08NhKs39zo43fTtl1fayCV7+DHV:r1gL5pRTcAkS/3hzN8qE43fm78V
TLSH
T10BA40815F6748631D073D0BAC5D3AA9AEE3230855B308ACB1286D7782F277E6C936731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2368-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2368-9-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2396-16-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2416-22-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4584-19-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4704-23-0x0000000000400000-0x0000000000414000-memory.dmp

Download