4d6b770114330906b0fd293eea07c28fbb8705013728e2a05fde977a02bd4425

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/04/2026, 16:28

Target
2026-04-22_6c765c7fcf5ed9c62a9103ae7fd2f471_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar.exe
Size 651KB
Sample260422-tythlsbw5m
SHA256 4d6b770114330906b0fd293eea07c28fbb8705013728e2a05fde977a02bd4425
MD5 6c765c7fcf5ed9c62a9103ae7fd2f471
SHA1 93dc910ceaef11b3a830a137c7883043f6b63f73
SHA512 c59c97e5b922164d053c316fdc6bf36711dab470f7e82ce386bc627bfd3e8aeca0cb3b369a2adb61b115772c61fdb8f50da5a2c267ce8bf1ebb9bb691b7fcc9f
SSDEEP 6144:ZZh3sx1hZbyss2q/AinXR5wzTIHBZtAuERkt6uTJNQF5311zGMEYdUxPnHn:luhZOssLnhiz08kXJ2bHzGyixPH
TLSH
T119E428D16B458CFAF388E03492028A727E5E79C7B6D295EF21CD612D1E375B11AF4E08
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 2044	4364	2026-04-22_6c765c7fcf5ed9c62a9103ae7fd2f471_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-04-22_6c765c7fcf5ed9c62a9103ae7fd2f471_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-22_6c765c7fcf5ed9c62a9103ae7fd2f471_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Windows\system32\curl.exe
  "curl" ip.sb
  2⤵
  PID:2044