5cdb94d6a2d1fadb47721d76f25753fed4439c692dd4862684f2128b949604d9

Analysis

max time kernel
148s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 01:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe
Size 6.6MB
Sample260602-cbjw8aa14x
SHA256 5cdb94d6a2d1fadb47721d76f25753fed4439c692dd4862684f2128b949604d9
MD5 2ab9daee2d57ef8b80bb91e8138424c2
SHA1 20b92d23e5958d2b1d239a999412be5b06e68c2f
SHA512 de686df9671014c8b37531ec94ab372154f4bd386675df0df3e23ea57e73fcfb95d7b4d1e358f84807e3f8517b607d1f34945f7d05aeae0c67aad73a7dcba899
SSDEEP 98304:bwt6w+Bmc/diLLb904+JYJmm5pQLY3e+/Wq+cN:63+TILae5yLYOm+cN
TLSH
T1F7668C03F28481ECD4AEC178C74B9732FA36B8990A20B6DF16D557313E6AE905F1E758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

credential_access defense_evasion discovery spyware stealer

Malware Config

Signatures

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	reg.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	reg.exe

Executes dropped EXE 2 IoCs

pid	Process
3136	chrome_abe_helper.exe
4536	chrome_abe_helper.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
3	discord.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com
1	ifconfig.me
4	ifconfig.me

Enumerates processes with tasklist 1 TTPs 8 IoCs

discovery

Process Discovery

T1057

pid	Process
3220	tasklist.exe
1520	tasklist.exe
2604	tasklist.exe
4744	tasklist.exe
1276	tasklist.exe
5088	tasklist.exe
2480	tasklist.exe
3908	tasklist.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4364	wmic.exe

Kills process with taskkill 6 IoCs

defense_evasion

pid	Process
3632	taskkill.exe
5064	taskkill.exe
3344	taskkill.exe
3716	taskkill.exe
2536	taskkill.exe
4168	taskkill.exe

Modifies registry key 1 TTPs 5 IoCs

Modify Registry

T1112

pid	Process
3436	reg.exe
3020	reg.exe
1824	reg.exe
1528	reg.exe
1840	reg.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5088	tasklist.exe
Token: SeDebugPrivilege	2480	tasklist.exe
Token: SeIncreaseQuotaPrivilege	1280	wmic.exe
Token: SeSecurityPrivilege	1280	wmic.exe
Token: SeTakeOwnershipPrivilege	1280	wmic.exe
Token: SeLoadDriverPrivilege	1280	wmic.exe
Token: SeSystemProfilePrivilege	1280	wmic.exe
Token: SeSystemtimePrivilege	1280	wmic.exe
Token: SeProfSingleProcessPrivilege	1280	wmic.exe
Token: SeIncBasePriorityPrivilege	1280	wmic.exe
Token: SeCreatePagefilePrivilege	1280	wmic.exe
Token: SeBackupPrivilege	1280	wmic.exe
Token: SeRestorePrivilege	1280	wmic.exe
Token: SeShutdownPrivilege	1280	wmic.exe
Token: SeDebugPrivilege	1280	wmic.exe
Token: SeSystemEnvironmentPrivilege	1280	wmic.exe
Token: SeRemoteShutdownPrivilege	1280	wmic.exe
Token: SeUndockPrivilege	1280	wmic.exe
Token: SeManageVolumePrivilege	1280	wmic.exe
Token: 33	1280	wmic.exe
Token: 34	1280	wmic.exe
Token: 35	1280	wmic.exe
Token: 36	1280	wmic.exe
Token: SeIncreaseQuotaPrivilege	1280	wmic.exe
Token: SeSecurityPrivilege	1280	wmic.exe
Token: SeTakeOwnershipPrivilege	1280	wmic.exe
Token: SeLoadDriverPrivilege	1280	wmic.exe
Token: SeSystemProfilePrivilege	1280	wmic.exe
Token: SeSystemtimePrivilege	1280	wmic.exe
Token: SeProfSingleProcessPrivilege	1280	wmic.exe
Token: SeIncBasePriorityPrivilege	1280	wmic.exe
Token: SeCreatePagefilePrivilege	1280	wmic.exe
Token: SeBackupPrivilege	1280	wmic.exe
Token: SeRestorePrivilege	1280	wmic.exe
Token: SeShutdownPrivilege	1280	wmic.exe
Token: SeDebugPrivilege	1280	wmic.exe
Token: SeSystemEnvironmentPrivilege	1280	wmic.exe
Token: SeRemoteShutdownPrivilege	1280	wmic.exe
Token: SeUndockPrivilege	1280	wmic.exe
Token: SeManageVolumePrivilege	1280	wmic.exe
Token: 33	1280	wmic.exe
Token: 34	1280	wmic.exe
Token: 35	1280	wmic.exe
Token: 36	1280	wmic.exe
Token: SeIncreaseQuotaPrivilege	3880	wmic.exe
Token: SeSecurityPrivilege	3880	wmic.exe
Token: SeTakeOwnershipPrivilege	3880	wmic.exe
Token: SeLoadDriverPrivilege	3880	wmic.exe
Token: SeSystemProfilePrivilege	3880	wmic.exe
Token: SeSystemtimePrivilege	3880	wmic.exe
Token: SeProfSingleProcessPrivilege	3880	wmic.exe
Token: SeIncBasePriorityPrivilege	3880	wmic.exe
Token: SeCreatePagefilePrivilege	3880	wmic.exe
Token: SeBackupPrivilege	3880	wmic.exe
Token: SeRestorePrivilege	3880	wmic.exe
Token: SeShutdownPrivilege	3880	wmic.exe
Token: SeDebugPrivilege	3880	wmic.exe
Token: SeSystemEnvironmentPrivilege	3880	wmic.exe
Token: SeRemoteShutdownPrivilege	3880	wmic.exe
Token: SeUndockPrivilege	3880	wmic.exe
Token: SeManageVolumePrivilege	3880	wmic.exe
Token: 33	3880	wmic.exe
Token: 34	3880	wmic.exe
Token: 35	3880	wmic.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 404 wrote to memory of 5088	404	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	80
PID 404 wrote to memory of 2480	404	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	83
PID 404 wrote to memory of 1280	404	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	85
PID 404 wrote to memory of 3880	404	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	87
PID 404 wrote to memory of 2520	404	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	89
PID 404 wrote to memory of 3436	404	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	91
PID 404 wrote to memory of 3020	404	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	93
PID 404 wrote to memory of 2852	404	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	95
PID 404 wrote to memory of 4588	404	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	97
PID 404 wrote to memory of 3908	404	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	99
PID 404 wrote to memory of 3980	404	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	101
PID 404 wrote to memory of 4364	404	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	103
PID 404 wrote to memory of 5004	404	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	105
PID 404 wrote to memory of 1596	404	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	107
PID 404 wrote to memory of 480	404	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	109
PID 404 wrote to memory of 1992	404	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	112
PID 404 wrote to memory of 1952	404	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	114
PID 404 wrote to memory of 3368	404	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	116
PID 404 wrote to memory of 3220	404	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	118
PID 404 wrote to memory of 3536	404	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	120
PID 404 wrote to memory of 3632	404	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	122
PID 404 wrote to memory of 5064	404	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	124
PID 404 wrote to memory of 3344	404	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	126
PID 404 wrote to memory of 3716	404	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	128
PID 404 wrote to memory of 2536	404	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	130
PID 404 wrote to memory of 3136	404	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	132
PID 3136 wrote to memory of 1220	3136	chrome_abe_helper.exe	134
PID 404 wrote to memory of 4536	404	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	135
PID 4536 wrote to memory of 3156	4536	chrome_abe_helper.exe	137
PID 404 wrote to memory of 2492	404	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	138
PID 404 wrote to memory of 4000	404	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	140
PID 404 wrote to memory of 1728	404	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	142
PID 404 wrote to memory of 3724	404	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	144
PID 404 wrote to memory of 1308	404	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	146
PID 404 wrote to memory of 228	404	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	148
PID 404 wrote to memory of 1176	404	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	150
PID 404 wrote to memory of 2124	404	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	152
PID 404 wrote to memory of 2748	404	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	154
PID 404 wrote to memory of 1432	404	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	156
PID 404 wrote to memory of 1824	404	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	158
PID 404 wrote to memory of 2012	404	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	160
PID 404 wrote to memory of 1184	404	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	162
PID 404 wrote to memory of 4040	404	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	164
PID 404 wrote to memory of 1520	404	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	166
PID 404 wrote to memory of 4168	404	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	168
PID 404 wrote to memory of 680	404	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	170
PID 680 wrote to memory of 3264	680	cmd.exe	172
PID 3776 wrote to memory of 2856	3776	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	175
PID 3776 wrote to memory of 3540	3776	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	177
PID 3776 wrote to memory of 2604	3776	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	179
PID 3776 wrote to memory of 4744	3776	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	181
PID 3776 wrote to memory of 1276	3776	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	183
PID 3776 wrote to memory of 5060	3776	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	185
PID 3776 wrote to memory of 2916	3776	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	187
PID 3776 wrote to memory of 4532	3776	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	189
PID 3776 wrote to memory of 1528	3776	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	191
PID 3776 wrote to memory of 1840	3776	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	193
PID 3776 wrote to memory of 4600	3776	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	195
PID 3776 wrote to memory of 4420	3776	2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe	197

C:\Users\Admin\AppData\Local\Temp\2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:404
- C:\Windows\system32\tasklist.exe
  "tasklist" /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5088
- C:\Windows\system32\tasklist.exe
  "tasklist" /m /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2480
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" diskdrive get model
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1280
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path Win32_VideoController get CurrentHorizontalResolution,CurrentVerticalResolution
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3880
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" os get lastbootuptime
  2⤵
  PID:2520
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SOFTWARE\Sandboxie
  2⤵
  - Modifies registry key
  PID:3436
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Services\Sandboxie
  2⤵
  - Modifies registry key
  PID:3020
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" process where processid=404 get parentprocessid
  2⤵
  PID:2852
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" process where processid=3160 get name
  2⤵
  PID:4588
- C:\Windows\system32\tasklist.exe
  "tasklist" /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  PID:3908
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get uuid
  2⤵
  PID:3980
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path win32_VideoController get name
  2⤵
  - Detects videocard installed
  PID:4364
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" memorychip get capacity
  2⤵
  PID:5004
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" diskdrive get size
  2⤵
  PID:1596
- C:\Windows\system32\getmac.exe
  "getmac" /fo csv /nh
  2⤵
  PID:480
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions"
  2⤵
  - Looks for VirtualBox Guest Additions in registry
  PID:1992
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools"
  2⤵
  - Looks for VMWare Tools registry key
  PID:1952
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\Microsoft\Virtual Machine"
  2⤵
  PID:3368
- C:\Windows\system32\tasklist.exe
  "tasklist" /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  PID:3220
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" computersystem get manufacturer
  2⤵
  PID:3536
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM chrome.exe /F
  2⤵
  - Kills process with taskkill
  PID:3632
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM msedge.exe /F
  2⤵
  - Kills process with taskkill
  PID:5064
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM brave.exe /F
  2⤵
  - Kills process with taskkill
  PID:3344
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM opera.exe /F
  2⤵
  - Kills process with taskkill
  PID:3716
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM vivaldi.exe /F
  2⤵
  - Kills process with taskkill
  PID:2536
- C:\Users\Admin\AppData\Local\Temp\chrome_abe_helper.exe
  "C:\Users\Admin\AppData\Local\Temp\chrome_abe_helper.exe" chrome QVBQQgEAAADQjJ3fARXREYx6AMBPwpfrAQAAANhAHUuC4lpEj3TvkXLRbzMQAAAAHAAAAEcAbwBvAGcAbABlACAAQwBoAHIAbwBtAGUAAAAQZgAAAAEAACAAAACgKYdIjVR/IQLBnGorxSDzoo3739hsmGkNLY1owZVN8QAAAAAOgAAAAAIAACAAAACSUQq2yX/kZQp2mBTJCEmnuPQvj18QpfrCbbTNM+d6LZABAACJvzldaKLxBdvFCMYdRfC40z8iYfVdd7kV1f6BHURip+INVbUZIGjHzYyoaQ2a4BvmpHEDHkX9MvHcle2WkXmEVT3eua0YFL9QzMJYT7nq02rEvvww+y7AM8WTDvvksWApSiIfewxdYGtAazUPZtcg1Cour45XI68390KmnKpv52xiPFA7c9eFAfZ6LeArFjdtY0pfKMkoL7+fxu5vjNDaWJz1aXiFbEEuU22jbKmf6d0kUL5akkP3H+P6lgu26knE8SFrWMrAjeKXHqt1apfXFwYDZ5sL1XtRYRIkzdcUdGYCo9ZGgqI1vL1MiF/g+yNJ/Cp6Jo6dyb1oJ7omWNq4R2zl445Li9idGtU2KnQK10IY5I90scFM9UzQ7ItNV4616Bo3UVEEh+4ytCnhi4qdyZxFf4mSRet3VTxRPad96nvhymxGJ6K0hrMx2uUPriakb49nT6GEZpRiA98el3aTkogQcCMXO1lmA4qxfr6tOKDsc8AFRx99EzDHYUJdxjmR3WtjmIWIqasEiUMiZHtqQAAAAE17OdNFjKOHCgf7AhVhCaoAxel+1N4eCMNb+SD8zeGAmwl0nS+rSn2QPDaEkHdTikhqSD2H+PAvzUyLn3db9fk=
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3136
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:1220
- C:\Users\Admin\AppData\Local\Temp\chrome_abe_helper.exe
  "C:\Users\Admin\AppData\Local\Temp\chrome_abe_helper.exe" chrome QVBQQgEAAADQjJ3fARXREYx6AMBPwpfrAQAAANhAHUuC4lpEj3TvkXLRbzMQAAAAHAAAAEcAbwBvAGcAbABlACAAQwBoAHIAbwBtAGUAAAAQZgAAAAEAACAAAACgKYdIjVR/IQLBnGorxSDzoo3739hsmGkNLY1owZVN8QAAAAAOgAAAAAIAACAAAACSUQq2yX/kZQp2mBTJCEmnuPQvj18QpfrCbbTNM+d6LZABAACJvzldaKLxBdvFCMYdRfC40z8iYfVdd7kV1f6BHURip+INVbUZIGjHzYyoaQ2a4BvmpHEDHkX9MvHcle2WkXmEVT3eua0YFL9QzMJYT7nq02rEvvww+y7AM8WTDvvksWApSiIfewxdYGtAazUPZtcg1Cour45XI68390KmnKpv52xiPFA7c9eFAfZ6LeArFjdtY0pfKMkoL7+fxu5vjNDaWJz1aXiFbEEuU22jbKmf6d0kUL5akkP3H+P6lgu26knE8SFrWMrAjeKXHqt1apfXFwYDZ5sL1XtRYRIkzdcUdGYCo9ZGgqI1vL1MiF/g+yNJ/Cp6Jo6dyb1oJ7omWNq4R2zl445Li9idGtU2KnQK10IY5I90scFM9UzQ7ItNV4616Bo3UVEEh+4ytCnhi4qdyZxFf4mSRet3VTxRPad96nvhymxGJ6K0hrMx2uUPriakb49nT6GEZpRiA98el3aTkogQcCMXO1lmA4qxfr6tOKDsc8AFRx99EzDHYUJdxjmR3WtjmIWIqasEiUMiZHtqQAAAAE17OdNFjKOHCgf7AhVhCaoAxel+1N4eCMNb+SD8zeGAmwl0nS+rSn2QPDaEkHdTikhqSD2H+PAvzUyLn3db9fk=
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4536
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:3156
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get uuid
  2⤵
  PID:2492
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" computersystem get manufacturer
  2⤵
  PID:4000
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" bios get serialnumber
  2⤵
  PID:1728
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" computersystem get model
  2⤵
  PID:3724
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" memorychip get capacity
  2⤵
  PID:1308
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path SoftwareLicensingService get OA3xOriginalProductKey
  2⤵
  PID:228
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" diskdrive get size
  2⤵
  PID:1176
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" logicaldisk get freespace
  2⤵
  PID:2124
- C:\Windows\system32\reg.exe
  "reg" query HKEY_CURRENT_USER\Software\Valve\Steam
  2⤵
  PID:2748
- C:\Windows\system32\reg.exe
  "reg" query "HKCU\Software\Martin Prikryl\WinSCP 2" /s
  2⤵
  PID:1432
- C:\Windows\system32\reg.exe
  "reg" query HKCU\Software\SimonTatham\PuTTY\Sessions /s
  2⤵
  - Modifies registry key
  PID:1824
- C:\Windows\system32\reg.exe
  "reg" query "HKCU\Software\Microsoft\Terminal Server Client\Default"
  2⤵
  PID:2012
- C:\Windows\system32\reg.exe
  "reg" query "HKCU\Software\Microsoft\Terminal Server Client\Servers"
  2⤵
  PID:1184
- C:\Windows\system32\cmdkey.exe
  "cmdkey" /list
  2⤵
  PID:4040
- C:\Windows\system32\tasklist.exe
  "tasklist" /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  PID:1520
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM Discord.exe /F
  2⤵
  - Kills process with taskkill
  PID:4168
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKCU\Software\Microsoft\Windows\CurrentVersion\Run\" /v Dissolute /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Temp\2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe\" /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:680
- - C:\Windows\system32\reg.exe
    reg add \"HKCU\Software\Microsoft\Windows\CurrentVersion\Run\" /v Dissolute /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Temp\2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe\" /f
    3⤵
    PID:3264

C:\Users\Admin\AppData\Local\Temp\2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-02_2ab9daee2d57ef8b80bb91e8138424c2_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3776
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" process where processid=3776 get parentprocessid
  2⤵
  PID:2856
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" process where processid=2712 get name
  2⤵
  PID:3540
- C:\Windows\system32\tasklist.exe
  "tasklist" /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  PID:2604
- C:\Windows\system32\tasklist.exe
  "tasklist" /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  PID:4744
- C:\Windows\system32\tasklist.exe
  "tasklist" /m /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  PID:1276
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" diskdrive get model
  2⤵
  PID:5060
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path Win32_VideoController get CurrentHorizontalResolution,CurrentVerticalResolution
  2⤵
  PID:2916
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" os get lastbootuptime
  2⤵
  PID:4532
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SOFTWARE\Sandboxie
  2⤵
  - Modifies registry key
  PID:1528
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Services\Sandboxie
  2⤵
  - Modifies registry key
  PID:1840
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get uuid
  2⤵
  PID:4600
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\cleanup.bat
  2⤵
  PID:4420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

chrome_abe_helper.exe

Path C:\Users\Admin\AppData\Local\Temp\chrome_abe_helper.exe
Size 200KB
SHA256 8e38ef9d787240b5eb73b75f1d02d625d209aae280ec8dd04e6871654055820c
MD5 de8b89770e7a31a5b48ca2009e70ca26
SHA1 1886b27ca8aad1e0abfd328c3b18ce62b41ddacb
SHA512 1db06da6ec840919b14021929879e55b529ca87048a201b180009470fc247c92a66276fabd705656b92e4ed1fba65317373b3fcf99b1787d5a306de363148733
SSDEEP 3072:XpZMnbYnd2Yg6u1UjpQvUilYJxsI9SqGxKpBdD/ewRriDC3:Xgac6oUjuUieJm8+Kpna+
TLSH
T1CF147C59B3A500F9E0B78179CD615A46E6727C050B609BDF03A00376EF376E05E3EB62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_abe_payload.dll

Path C:\Users\Admin\AppData\Local\Temp\chrome_abe_payload.dll
Size 149KB
SHA256 f73fccb8334fbceb69541aaeaead317a3e9605a1682d7a0f2c8ccb97560e92de
MD5 0e16d9d05e6c3a3b6a0d90390589d44c
SHA1 d9b17914d7408c6eafc4143ff0e81088458542f3
SHA512 e12dcaed63e4fa6a41432074c17e8221a4fd8dc32d8aa508be9ee5b333fc6349b9666ca48e9adf70e3b8ed5ffabf24bf3d1e3be90b24dd967a1f44505de7352b
SSDEEP 1536:qmovw7iI5kE85WC2RDoLndAnNLO0ZvPXg5zemG0rxekxG5BTHSSuqzXqG4m1ozph:/ovwuMcdK1sz13ekwylUqG4Bp7IOFv
TLSH
T14EE35B17B3A500BBE0778278C9A30A46E77678151B609BEF03A443796F277D09D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cleanup.bat

Path C:\Users\Admin\AppData\Local\Temp\cleanup.bat
Size 377B
SHA256 90a456b4ee18f2cbfdfbb572fb329e7d73c2902f839422eb4b2b4f884d95ca31
MD5 082ec942e1be70e6762e6b91d7397980
SHA1 d64faf6c3cebdff9fc95d8af704abb160aad3610
SHA512 f4b7e0383c3b16470a9e52c1edd969f65b6f9e06f857212eaf1b833ca4f34c03d60b0a900e889758f8a34e43c7139c952b642aa8aacc580a9b5f90edb87b8e43
TLSH
T1B5E0680E4563DFDB8831A1F392780CAEA004644D2F4B128843D0658F60D624F728128A
MD5 SHA1 SHA512 TLSH

Submit Download

dissolute_debug.log

Path C:\Users\Admin\AppData\Local\Temp\dissolute_debug.log
Size 4KB
SHA256 350d96668e213ace32610aa56c5c10ee9891c58be43054164840538f8594569e
MD5 e47a52b6c2acc0aa4b4382e949e98a6c
SHA1 4a885d3e6695bccf81c21eda3319124744443bb2
SHA512 4b23bf99289b87629c7219eba49f24399152704111a2b1445999ba8670ea0b1ee99f51277318bed072054a1e9937110088d8e2d0ec73d9d72d08b0e031e5cec4
SSDEEP 96:PXdEX/etDwT/NzdLb5OmF6sZdLbq/84mVoI/WxrnVxrxOkfPrXNZqq:vibhztbs2tbk7djz9Mq
TLSH
T17AA1551233DCDB2CF193D07712B5882E8EB1C9332B516F1097ED804CA54560EB6AB6F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dissolute_debug.log

Path C:\Users\Admin\AppData\Local\Temp\dissolute_debug.log
Size 8KB
SHA256 6aefeb964c4f983914a229de3f0d37d01851386f7464a8a7792dfcff1b4aeb92
MD5 68709710677f9a6b1553d5d3ec8bbf83
SHA1 fed068c4e77a1ebf08c8ddbacbccb00a50d69d1f
SHA512 cb2cffd7238d299069ffd5430d5e96368e3d1bb1be7d40e223edcb0c9a549f1c23c9fbbf4acba5c738bf4f38dc1c8251a11b870b2dc3a0b646602bd306c04d31
SSDEEP 96:PXdEX/etDwT/NzdLb5OmF6sZdLbq/84mVoI/WxrnVxrxOkfPrXNZqIpEEfOMm6WW:vibhztbs2tbk7djz9MIpjxRC9D7u/Iq
TLSH
T14902756D61CDCB2DE163D4B31263993DC7369D1B5F426F3092CC80CCE90160F696AAE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dissolute_debug.log

Path C:\Users\Admin\AppData\Local\Temp\dissolute_debug.log
Size 2KB
SHA256 1dea6ff21245ae338048d590ba223cdf5e564d7a0d6c17fe3f0773457670fb1c
MD5 4afb5bb9301c978854b9b89a86d8ed1f
SHA1 c4d6929577e8ae9df832f68fadb874ef0a65f893
SHA512 f201bd8732f2fc92af08129edb5543f7a96f8e567823e0f5802cd01a4ce0e9f6c5c9b4e9094d30a4b710f9ab8b8c734b84043a7f04dfe6de1c27771552d2618a
TLSH
T10D41F10276A5DB2CF18392B71125852F9D318C3B47936F006A6ED148E70D709B7AE771
MD5 SHA1 SHA512 TLSH

Submit Download

dissolute_debug.log

Path C:\Users\Admin\AppData\Local\Temp\dissolute_debug.log
Size 3KB
SHA256 a1512b4a44d1f0a2908efedea7ef0bd6b29ce326a1b003eabb34bd29deb4ab7e
MD5 e5ec452a1f130b2b8942740322c889c6
SHA1 49c734ffb6ca966db508f1e296663abbb18e8ab6
SHA512 8622164475825bbb6be3aeb56ecdae44e4094c3ece99ea1349e2bcd3b39d7ff4b2ce1285b46f16b12a3ed3a74b6021e4b2b1b8a59f9ebc21f30ddb27646af54d
TLSH
T17A61140237ECDB2CF59391B311B4891F8D71893757526F1056AD8148E60A70EB79E7B2
MD5 SHA1 SHA512 TLSH

Submit Download

discord.yaml

Path C:\Users\Admin\AppData\Local\Temp\dissolute_zslesr\data\discord.yaml
Size 3B
SHA256 37517e5f3dc66819f61f5a7bb8ace1921282415f10551d2defa5c3eb0985b570
MD5 58e0494c51d30eb3494f7c9198986bb9
SHA1 cd0d4cc32346750408f7d4f5e78ec9a6e5b79a0d
SHA512 b7a9336ed3a424b5d4d59d9b20d0bbc33217207b584db6b758fddb9a70b99e7c8c9f8387ef318a6b2039e62f09a3a2592bf5c76d6947a6ea1d107b924d7461f4
MD5 SHA1 SHA512

Submit Download

passwords.yaml

Path C:\Users\Admin\AppData\Local\Temp\dissolute_zslesr\data\passwords.yaml
Size 3B
SHA256 ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
MD5 8a80554c91d9fca8acb82f023de02f11
SHA1 5f36b2ea290645ee34d943220a14b54ee5ea5be5
SHA512 ca4b6defb8adcc010050bc8b1bb8f8092c4928b8a0fba32146abcfb256e4d91672f88ca2cdf6210e754e5b8ac5e23fb023806ccd749ac8b701f79a691f03c87a
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads