Overview

overview

10

Static

static

10

2026-05-31...wo.exe

windows10-2004-x64

9

2026-05-31...wo.exe

windows11-21h2-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    96s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    31/05/2026, 06:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-31_25b66845ecdbd9c2d02d9a48570eccc7_akira_blankgrabber_cobalt-strike_coinminer_dosia_glasswo.exe
  • Size 109.5MB
  • Sample260531-hchnfaa13t
  • SHA256 969662b0e7cccbcab7f4b6c54e1ef58457d331735011aacdca66c37443b7d1d8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10

Malware Config

Signatures

  • Custom signature
    Detects Windows executables referencing non-Windows User-Agents 1 IoCs
  • Custom signature
    Detects executables containing URLs to raw contents of a Github gist 14 IoCs
  • Custom signature
    Detects executables containing base64 encoded User Agent 14 IoCs
  • Loads dropped DLL 38 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-31_25b66845ecdbd9c2d02d9a48570eccc7_akira_blankgrabber_cobalt-strike_coinminer_dosia_glasswo.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-31_25b66845ecdbd9c2d02d9a48570eccc7_akira_blankgrabber_cobalt-strike_coinminer_dosia_glasswo.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5108
    • C:\Users\Admin\AppData\Local\Temp\2026-05-31_25b66845ecdbd9c2d02d9a48570eccc7_akira_blankgrabber_cobalt-strike_coinminer_dosia_glasswo.exe
      C:\Users\Admin\AppData\Local\Temp\2026-05-31_25b66845ecdbd9c2d02d9a48570eccc7_akira_blankgrabber_cobalt-strike_coinminer_dosia_glasswo.exe
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2448

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        81d243bd2c585b0f4821__mypyc.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5108_588385_tPaiW8wGeoY\81d243bd2c585b0f4821__mypyc.pyd
        • Size 213KB
        • SHA256 ba7fc544994f126cb7485ce52d265d2f32e93c4f1ea1fcd6fcdee3918f271979
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5108_588385_tPaiW8wGeoY\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5108_588385_tPaiW8wGeoY\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _asyncio.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5108_588385_tPaiW8wGeoY\_asyncio.pyd
        • Size 71KB
        • SHA256 423007b8c7d63b4cb5f23665a761dd5de1c7e15a65c8013391de0d18c89ce417
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5108_588385_tPaiW8wGeoY\_bz2.pyd
        • Size 84KB
        • SHA256 1bf985b54f529a3cbb3e52532791cc4d4c64009142d37b54eb3521adec203d5c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _cffi_backend.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5108_588385_tPaiW8wGeoY\_cffi_backend.pyd
        • Size 176KB
        • SHA256 d5b09da2e726b4e90cf0edad5d2a0ec52f369dfd060e14d3807a32b2205031fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5108_588385_tPaiW8wGeoY\_ctypes.pyd
        • Size 131KB
        • SHA256 96b07339d52c74f2a1dd043df5eb931e4072eed90a3a8715ffec751d818e4117
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _decimal.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5108_588385_tPaiW8wGeoY\_decimal.pyd
        • Size 280KB
        • SHA256 398117a6af493e34f56ec0d78ced9901b20b8e895686ce5966edeadb23507056
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5108_588385_tPaiW8wGeoY\_hashlib.pyd
        • Size 67KB
        • SHA256 50f3ce7a2281fd32f378f3ba5067bdd13e18ee95877db5199c6a0babdc9c516a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5108_588385_tPaiW8wGeoY\_lzma.pyd
        • Size 155KB
        • SHA256 51815b6474d4216c6a2aeaffdae5d2ff4acb7a0236254f2cfe43247022f3d781
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _multiprocessing.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5108_588385_tPaiW8wGeoY\_multiprocessing.pyd
        • Size 37KB
        • SHA256 4df0d8f9da454831e96389c145ac9ea0093e09749627a3717ff60d21218670c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _overlapped.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5108_588385_tPaiW8wGeoY\_overlapped.pyd
        • Size 56KB
        • SHA256 53fe68819f23fea7f6deb0054623e936cc2500241061f29bd5288cf4a511278f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5108_588385_tPaiW8wGeoY\_queue.pyd
        • Size 34KB
        • SHA256 b5b5368026c33ade7651fb4cf4c6c1ca7eecc9c8cdad0af007da8a3ac0e067f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5108_588385_tPaiW8wGeoY\_socket.pyd
        • Size 84KB
        • SHA256 8676f3cebd9d01c7ad51a29b3f7ff429c0a8f6bc564cab21eb6cdaa2e26fd259
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5108_588385_tPaiW8wGeoY\_ssl.pyd
        • Size 177KB
        • SHA256 b8118580b461801df12ec12d3d666aa0ebc2b3750bcf92b90b92789b152bf856
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _uuid.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5108_588385_tPaiW8wGeoY\_uuid.pyd
        • Size 27KB
        • SHA256 0116497261edadfe42ba7daf367c8a9ea27a1db210c8384943c890f532e3ce72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5108_588385_tPaiW8wGeoY\_wmi.pyd
        • Size 38KB
        • SHA256 9a7255064ea143895b28efea6d78e9e518bac290900aec52a6a0435c36a172fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _zoneinfo.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5108_588385_tPaiW8wGeoY\_zoneinfo.pyd
        • Size 49KB
        • SHA256 6351ce1ff38815e152bb8f28b884e7b2a3945cbee1b1fefa6117e45953d5751f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cd.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5108_588385_tPaiW8wGeoY\charset_normalizer\cd.pyd
        • Size 10KB
        • SHA256 2e9f5049b3c5db7ab78c6abb94dfbbfe035ebab8f40594320f8c92221f486f24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wrapper.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5108_588385_tPaiW8wGeoY\curl_cffi\_wrapper.pyd
        • Size 3.1MB
        • SHA256 f640dce86563f9814a11c5452cb84eef85c58243eab37d6ccb9672a966148112
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5108_588385_tPaiW8wGeoY\libcrypto-3.dll
        • Size 5.0MB
        • SHA256 eaf6d613b95b61a39558d84c50e72630a66c99914292df88e7b54ebd60c5bd34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5108_588385_tPaiW8wGeoY\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5108_588385_tPaiW8wGeoY\libssl-3.dll
        • Size 776KB
        • SHA256 cf1a5fdcefa3daf69041f31f98ece1d7911ca4fcb8e9f1043b4d0f459ae4c936
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _pydantic_core.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5108_588385_tPaiW8wGeoY\pydantic_core\_pydantic_core.pyd
        • Size 5.0MB
        • SHA256 0c4e9ba0b8da2a7148ff6771f258f53edab4a848c43a8d36593dd4170f340507
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5108_588385_tPaiW8wGeoY\python3.dll
        • Size 70KB
        • SHA256 cbc4876275178244905ee45a9ee6ec9fa4bfb9aad6209a03b756d38a186f80d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python313.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5108_588385_tPaiW8wGeoY\python313.dll
        • Size 5.8MB
        • SHA256 6964e590037c41d631fd1215f05af154f7fa68105993c6f573a20689b473f1ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pywintypes313.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5108_588385_tPaiW8wGeoY\pywintypes313.dll
        • Size 132KB
        • SHA256 9bb6dece38380abc747dce9ba8b0834a2bec469bc942dbcc8658e30ebdfb59a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5108_588385_tPaiW8wGeoY\select.pyd
        • Size 32KB
        • SHA256 ddf1221851814943a82ed8a986d228463404da2ada969661bdd69223f14fc050
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5108_588385_tPaiW8wGeoY\unicodedata.pyd
        • Size 695KB
        • SHA256 b965a80346ee95dbec0b147faab329f3276ba24fceb8df5df171367649f116f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32gui.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5108_588385_tPaiW8wGeoY\win32gui.pyd
        • Size 218KB
        • SHA256 6c545bd22720a7088c1353e5e554ded4db5db4c1b164689e7d42acf312561aca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2448-108-0x000001E0E3E10000-0x000001E0E80FE000-memory.dmp
        Download

        memory/2448-109-0x000001E0E3E10000-0x000001E0E80FE000-memory.dmp
        Download

        memory/2448-110-0x000001E0E3E10000-0x000001E0E80FE000-memory.dmp
        Download

        memory/2448-111-0x000001E0E3E10000-0x000001E0E80FE000-memory.dmp
        Download

        memory/2448-112-0x000001E0E3E10000-0x000001E0E80FE000-memory.dmp
        Download

        memory/2448-113-0x000001E0E3E10000-0x000001E0E80FE000-memory.dmp
        Download

        memory/2448-114-0x000001E0E3E10000-0x000001E0E80FE000-memory.dmp
        Download

        memory/2448-115-0x000001E0E3E10000-0x000001E0E80FE000-memory.dmp
        Download

        memory/2448-116-0x000001E0E3E10000-0x000001E0E80FE000-memory.dmp
        Download

        memory/2448-117-0x000001E0E3E10000-0x000001E0E80FE000-memory.dmp
        Download

        memory/2448-118-0x000001E0E3E10000-0x000001E0E80FE000-memory.dmp
        Download

        memory/2448-119-0x000001E0E3E10000-0x000001E0E80FE000-memory.dmp
        Download

        memory/2448-120-0x000001E0E3E10000-0x000001E0E80FE000-memory.dmp
        Download

        memory/2448-121-0x000001E0E3E10000-0x000001E0E80FE000-memory.dmp
        Download