36af29597c0ee2c7d4d25b677cd24798379f206ef0a7f94e1da4a83f1b002c25

Analysis

max time kernel
15s
max time network
6s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 11:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-14_d354d49e22696d6a72168917066b6d0d_akira_amadey_cobalt-strike_elex_hijackloader_icedid_ipam.exe
Size 6.6MB
Sample261014-njgbvatycs
SHA256 36af29597c0ee2c7d4d25b677cd24798379f206ef0a7f94e1da4a83f1b002c25
MD5 d354d49e22696d6a72168917066b6d0d
SHA1 d151787f351d6c0fc3ab96379feeeea99c973429
SHA512 7470ec80443d29ba5602f1bd084bd73f20c387273accd0888db3cb72400426deb900f8002c15804a8b5048bfe063ba24854c48c06f1e6f4469c7d55367c6c003
SSDEEP 98304:kthUgTH2M2m9UMpu1QfLczqssnKS8dV6E:DgTH2qBpu1QfLIqsuf8dV6E
TLSH
T1EB66D61162D99FDCC05FD474CE4669A16A237C458F21AFDF0980BE293E766B06E3821F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence

Malware Config

Signatures

Detects executables packed with ASPack 8 IoCs

resource	yara_rule
behavioral2/memory/4484-0-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c5d3-8.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4484-10-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4400-16-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c5d5-17.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4200-19-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4924-20-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3336-21-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 5 IoCs

pid	Process
3336	MSWDM.EXE
4200	MSWDM.EXE
2552	2026-10-14_D354D49E22696D6A72168917066B6D0D_AKIRA_AMADEY_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_IPAM.EXE
4400	MSWDM.EXE
4924	MSWDM.EXE

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	2026-10-14_d354d49e22696d6a72168917066b6d0d_akira_amadey_cobalt-strike_elex_hijackloader_icedid_ipam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	2026-10-14_d354d49e22696d6a72168917066b6d0d_akira_amadey_cobalt-strike_elex_hijackloader_icedid_ipam.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\MSWDM.EXE	2026-10-14_d354d49e22696d6a72168917066b6d0d_akira_amadey_cobalt-strike_elex_hijackloader_icedid_ipam.exe
File opened for modification	C:\Windows\dev4ABB.tmp	2026-10-14_d354d49e22696d6a72168917066b6d0d_akira_amadey_cobalt-strike_elex_hijackloader_icedid_ipam.exe
File opened for modification	C:\Windows\dev4ABB.tmp	MSWDM.EXE

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MSWDM.EXE

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-14_d354d49e22696d6a72168917066b6d0d_akira_amadey_cobalt-strike_elex_hijackloader_icedid_ipam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4200	MSWDM.EXE
4200	MSWDM.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 3336	4484	2026-10-14_d354d49e22696d6a72168917066b6d0d_akira_amadey_cobalt-strike_elex_hijackloader_icedid_ipam.exe	89
PID 4484 wrote to memory of 4200	4484	2026-10-14_d354d49e22696d6a72168917066b6d0d_akira_amadey_cobalt-strike_elex_hijackloader_icedid_ipam.exe	90
PID 4200 wrote to memory of 2552	4200	MSWDM.EXE	92
PID 4200 wrote to memory of 4400	4200	MSWDM.EXE	94

C:\Users\Admin\AppData\Local\Temp\2026-10-14_d354d49e22696d6a72168917066b6d0d_akira_amadey_cobalt-strike_elex_hijackloader_icedid_ipam.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-14_d354d49e22696d6a72168917066b6d0d_akira_amadey_cobalt-strike_elex_hijackloader_icedid_ipam.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4484
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3336
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\dev4ABB.tmp!C:\Users\Admin\AppData\Local\Temp\2026-10-14_d354d49e22696d6a72168917066b6d0d_akira_amadey_cobalt-strike_elex_hijackloader_icedid_ipam.exe! !
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4200
- - C:\Users\Admin\AppData\Local\Temp\2026-10-14_D354D49E22696D6A72168917066B6D0D_AKIRA_AMADEY_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_IPAM.EXE
    3⤵
    - Executes dropped EXE
    PID:2552
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\dev4ABB.tmp!C:\Users\Admin\AppData\Local\Temp\2026-10-14_D354D49E22696D6A72168917066B6D0D_AKIRA_AMADEY_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_IPAM.EXE!
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4400

C:\Windows\MSWDM.EXE
MSWDM.EXE
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:4924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-10-14_D354D49E22696D6A72168917066B6D0D_AKIRA_AMADEY_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_IPAM.EXE

Path C:\Users\Admin\AppData\Local\Temp\2026-10-14_D354D49E22696D6A72168917066B6D0D_AKIRA_AMADEY_COBALT-STRIKE_ELEX_HIJACKLOADER_ICEDID_IPAM.EXE
Size 6.6MB
SHA256 4e8148244be7a63df20b0170248a409b404f2ed2c69bb3803da376b62abe9217
MD5 81ae3aae969a66d361c774b3bbb00bd1
SHA1 3736ed7f1121b0acdfbf48f01269e3fa929bef13
SHA512 0d473aeb120fe85ed19909ac633f0273b35d11dcca70bd6deb78ebffb8da791a6aa632e275337a4cddc0574f4f2d390d703d9ecfe268a2cda9bdb21acf513ff2
SSDEEP 98304:kthUgTH2M2m9UMpu1QfLczqssnKS8dV6U:DgTH2qBpu1QfLIqsuf8dV6U
TLSH
T17266D61162D99FDCC05FD474CE4669A16A237C458F21AFDF0980BE293E766B06E3821F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSWDM.EXE

Path C:\Windows\MSWDM.EXE
Size 6.1MB
SHA256 97aecd752d7cd6e818bcb65ac93d6e9f38c064404f88e112d82c7019243a85e2
MD5 2e9107183a52a157880c76422f7fc5b3
SHA1 e71664c215d359ae1540967b46efc4605b1cf707
SHA512 64501843a874f0e23b68d59653925c21b30d7da966d02b53ec25fbe3608e3f0ded45bd9679c7c5e7419e47f23b1245a3ca03653f187b5650a7143fbe2fe481d5
SSDEEP 49152:kthU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPBq/Uybpn:kthUgTH2M2m9UMpu1QfLczqssnKS8dM
TLSH
T10056C51165DA9FDCC05FA474CE0669B16A237C468F61AFDF09807E293E756B06E3820F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dev4ABB.tmp

Path C:\Windows\dev4ABB.tmp
Size 458KB
SHA256 344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
MD5 619f7135621b50fd1900ff24aade1524
SHA1 6c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA512 2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
SSDEEP 6144:fz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktNP08NhKs39zo43fTtl1fayCV7+DHV:r1gL5pRTcAkS/3hzN8qE43fm78V
TLSH
T10BA40815F6748631D073D0BAC5D3AA9AEE3230855B308ACB1286D7782F277E6C936731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3336-21-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4200-19-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4400-16-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4484-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4484-10-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4924-20-0x0000000000400000-0x0000000000414000-memory.dmp

Download