4d6b770114330906b0fd293eea07c28fbb8705013728e2a05fde977a02bd4425

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/04/2026, 16:28

Target
2026-04-22_6c765c7fcf5ed9c62a9103ae7fd2f471_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar.exe
Size 651KB
Sample260422-tythlsbw5m
SHA256 4d6b770114330906b0fd293eea07c28fbb8705013728e2a05fde977a02bd4425
MD5 6c765c7fcf5ed9c62a9103ae7fd2f471
SHA1 93dc910ceaef11b3a830a137c7883043f6b63f73
SHA512 c59c97e5b922164d053c316fdc6bf36711dab470f7e82ce386bc627bfd3e8aeca0cb3b369a2adb61b115772c61fdb8f50da5a2c267ce8bf1ebb9bb691b7fcc9f
SSDEEP 6144:ZZh3sx1hZbyss2q/AinXR5wzTIHBZtAuERkt6uTJNQF5311zGMEYdUxPnHn:luhZOssLnhiz08kXJ2bHzGyixPH
TLSH
T119E428D16B458CFAF388E03492028A727E5E79C7B6D295EF21CD612D1E375B11AF4E08
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5944 wrote to memory of 5720	5944	2026-04-22_6c765c7fcf5ed9c62a9103ae7fd2f471_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar.exe	79

C:\Users\Admin\AppData\Local\Temp\2026-04-22_6c765c7fcf5ed9c62a9103ae7fd2f471_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-22_6c765c7fcf5ed9c62a9103ae7fd2f471_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5944
- C:\Windows\system32\curl.exe
  "curl" ip.sb
  2⤵
  PID:5720