1bad949c7123991d44995098639b37b37dcebd8ccdfbdce9ef7fafcbcc2b6db3

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/05/2026, 23:23

Target
2026-05-16_aa61a5a15c4754a194211bc58ce5a12e_akira_cobalt-strike_coinminer_glassworm_satacom_vidar.exe
Size 40.1MB
Sample260516-3dlrpsdy7n
SHA256 1bad949c7123991d44995098639b37b37dcebd8ccdfbdce9ef7fafcbcc2b6db3
MD5 aa61a5a15c4754a194211bc58ce5a12e
SHA1 14789af8b4ecef98f70b12b60908167314a47e66
SHA512 79dbf7ce15bcce7e77951fb6b325d6b824aa207260df24af683ef77e52ea381c34d191c733389831c7b10ca5d146a4217edc2c12a406f8aa4f62bc96479cae1b
SSDEEP 393216:0hQwpURg9cnHV1i2lL2khGLgtVNfYcEqC:0hQwqPHxljIqC
TLSH
T1CF974B47629801DCD5AAD2B98B1E8D03F671745A0335C7DB07E0DAA72FAB6E09E7D310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4500	2026-05-16_aa61a5a15c4754a194211bc58ce5a12e_akira_cobalt-strike_coinminer_glassworm_satacom_vidar.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4500	2026-05-16_aa61a5a15c4754a194211bc58ce5a12e_akira_cobalt-strike_coinminer_glassworm_satacom_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 768	4500	2026-05-16_aa61a5a15c4754a194211bc58ce5a12e_akira_cobalt-strike_coinminer_glassworm_satacom_vidar.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-05-16_aa61a5a15c4754a194211bc58ce5a12e_akira_cobalt-strike_coinminer_glassworm_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-16_aa61a5a15c4754a194211bc58ce5a12e_akira_cobalt-strike_coinminer_glassworm_satacom_vidar.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Users\Admin\AppData\Local\Temp\2026-05-16_aa61a5a15c4754a194211bc58ce5a12e_akira_cobalt-strike_coinminer_glassworm_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-05-16_aa61a5a15c4754a194211bc58ce5a12e_akira_cobalt-strike_coinminer_glassworm_satacom_vidar.exe" --type=collab-renderer --proc=4500
  2⤵
  PID:768