7e7c1313ebfd6c1a6bd91e6439525a168045da314db860ff23de98fe7a763a9e

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-02_6fa7fecd4112982812e00cbbead30a1c_akira_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
Size 34.1MB
Sample260602-phqdsses4p
SHA256 7e7c1313ebfd6c1a6bd91e6439525a168045da314db860ff23de98fe7a763a9e
MD5 6fa7fecd4112982812e00cbbead30a1c
SHA1 883f24b65006036955fe16ac07cbb0f70ee4d0f1
SHA512 c391cc43e77c57e2ce1fff8242ad3bd0400d7ac3e26f9306144e972e4a50d685f4efbbcb0d26379676a6efd48e808107c946dd91d134042087c52eaab699e8df
SSDEEP 393216:rTfd8gho7/nPavS8wTkJrJVauYjP7AsNZCRPuU8:fF8dnPavStirJghjrD0b8
TLSH
T17A776C03BE8618A9D09DC474834B46639A617CDB0B3AB9FF25C535252F7EAF05B3A314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

execution

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
2	raw.githubusercontent.com

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4388	powershell.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3244	2026-06-02_6fa7fecd4112982812e00cbbead30a1c_akira_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
3244	2026-06-02_6fa7fecd4112982812e00cbbead30a1c_akira_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
4388	powershell.exe
4388	powershell.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4136	wmic.exe
Token: SeSecurityPrivilege	4136	wmic.exe
Token: SeTakeOwnershipPrivilege	4136	wmic.exe
Token: SeLoadDriverPrivilege	4136	wmic.exe
Token: SeSystemProfilePrivilege	4136	wmic.exe
Token: SeSystemtimePrivilege	4136	wmic.exe
Token: SeProfSingleProcessPrivilege	4136	wmic.exe
Token: SeIncBasePriorityPrivilege	4136	wmic.exe
Token: SeCreatePagefilePrivilege	4136	wmic.exe
Token: SeBackupPrivilege	4136	wmic.exe
Token: SeRestorePrivilege	4136	wmic.exe
Token: SeShutdownPrivilege	4136	wmic.exe
Token: SeDebugPrivilege	4136	wmic.exe
Token: SeSystemEnvironmentPrivilege	4136	wmic.exe
Token: SeRemoteShutdownPrivilege	4136	wmic.exe
Token: SeUndockPrivilege	4136	wmic.exe
Token: SeManageVolumePrivilege	4136	wmic.exe
Token: 33	4136	wmic.exe
Token: 34	4136	wmic.exe
Token: 35	4136	wmic.exe
Token: 36	4136	wmic.exe
Token: SeDebugPrivilege	4388	powershell.exe
Token: SeIncreaseQuotaPrivilege	4136	wmic.exe
Token: SeSecurityPrivilege	4136	wmic.exe
Token: SeTakeOwnershipPrivilege	4136	wmic.exe
Token: SeLoadDriverPrivilege	4136	wmic.exe
Token: SeSystemProfilePrivilege	4136	wmic.exe
Token: SeSystemtimePrivilege	4136	wmic.exe
Token: SeProfSingleProcessPrivilege	4136	wmic.exe
Token: SeIncBasePriorityPrivilege	4136	wmic.exe
Token: SeCreatePagefilePrivilege	4136	wmic.exe
Token: SeBackupPrivilege	4136	wmic.exe
Token: SeRestorePrivilege	4136	wmic.exe
Token: SeShutdownPrivilege	4136	wmic.exe
Token: SeDebugPrivilege	4136	wmic.exe
Token: SeSystemEnvironmentPrivilege	4136	wmic.exe
Token: SeRemoteShutdownPrivilege	4136	wmic.exe
Token: SeUndockPrivilege	4136	wmic.exe
Token: SeManageVolumePrivilege	4136	wmic.exe
Token: 33	4136	wmic.exe
Token: 34	4136	wmic.exe
Token: 35	4136	wmic.exe
Token: 36	4136	wmic.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3244 wrote to memory of 4388	3244	2026-06-02_6fa7fecd4112982812e00cbbead30a1c_akira_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	81
PID 3244 wrote to memory of 4136	3244	2026-06-02_6fa7fecd4112982812e00cbbead30a1c_akira_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	82
PID 4388 wrote to memory of 4384	4388	powershell.exe	84
PID 4384 wrote to memory of 2024	4384	csc.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-06-02_6fa7fecd4112982812e00cbbead30a1c_akira_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-02_6fa7fecd4112982812e00cbbead30a1c_akira_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Encoded WwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAJwB7ACIAUwBjAHIAaQBwAHQAIgA6ACIAYQBXAFkAZwBLAEMAMQB1AGIAMwBRAGcASwBGAHQAVABlAFgATgAwAFoAVwAwAHUAVABXAEYAdQBZAFcAZABsAGIAVwBWAHUAZABDADUAQgBkAFgAUgB2AGIAVwBGADAAYQBXADkAdQBMAGwAQgBUAFYASABsAHcAWgBVADUAaABiAFcAVgBkAEoAMQBkAHAAYgBqAE0AeQBKAHkAawB1AFYASABsAHcAWgBTAGsAZwBlAHcAMABLAEkAQwBBAGcASQBFAEYAawBaAEMAMQBVAGUAWABCAGwASQBFAEEAaQBEAFEAbwBnAEkAQwBBAGcAZABYAE4AcABiAG0AYwBnAFUAMwBsAHoAZABHAFYAdABPAHcAMABLAEkAQwBBAGcASQBIAFYAegBhAFcANQBuAEkARgBOADUAYwAzAFIAbABiAFMANQBTAGQAVwA1ADAAYQBXADEAbABMAGsAbAB1AGQARwBWAHkAYgAzAEIAVABaAFgASgAyAGEAVwBOAGwAYwB6AHMATgBDAGcAMABLAEkAQwBBAGcASQBIAEIAMQBZAG0AeABwAFkAeQBCAGoAYgBHAEYAegBjAHkAQgBYAGEAVwA0AHoATQBpAEIANwBEAFEAbwBnAEkAQwBBAGcASQBDAEEAZwBJAEYAdABFAGIARwB4AEoAYgBYAEIAdgBjAG4AUQBvAEkAbgBWAHoAWgBYAEkAegBNAGkANQBrAGIARwB3AGkASwBWADAATgBDAGkAQQBnAEkAQwBBAGcASQBDAEEAZwBjAEgAVgBpAGIARwBsAGoASQBIAE4AMABZAFgAUgBwAFkAeQBCAGwAZQBIAFIAbABjAG0ANABnAFMAVwA1ADAAVQBIAFIAeQBJAEUAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAFgAYQBXADUAawBiADMAYwBvAEsAVABzAE4AQwBnADAASwBJAEMAQQBnAEkAQwBBAGcASQBDAEIAYgBSAEcAeABzAFMAVwAxAHcAYgAzAEoAMABLAEMASgAxAGMAMgBWAHkATQB6AEkAdQBaAEcAeABzAEkAaQBsAGQARABRAG8AZwBJAEMAQQBnAEkAQwBBAGcASQBGAHQAeQBaAFgAUgAxAGMAbQA0ADYASQBFADEAaABjAG4ATgBvAFkAVwB4AEIAYwB5AGgAVgBiAG0AMQBoAGIAbQBGAG4AWgBXAFIAVQBlAFgAQgBsAEwAawBKAHYAYgAyAHcAcABYAFEAMABLAEkAQwBBAGcASQBDAEEAZwBJAEMAQgB3AGQAVwBKAHMAYQBXAE0AZwBjADMAUgBoAGQARwBsAGoASQBHAFYANABkAEcAVgB5AGIAaQBCAGkAYgAyADkAcwBJAEYATgBvAGIAMwBkAFgAYQBXADUAawBiADMAYwBvAFMAVwA1ADAAVQBIAFIAeQBJAEcAaABYAGIAbQBRAHMASQBHAGwAdQBkAEMAQgB1AFEAMgAxAGsAVQAyAGgAdgBkAHkAawA3AEQAUQBvAGcASQBDAEEAZwBmAFEAMABLAEkAawBBAE4AQwBuADAATgBDAG0AWgAxAGIAbQBOADAAYQBXADkAdQBJAEUAZABsAGQARQBGAGoAZABHAGwAMgBaAFYAZABwAGIAbQBSAHYAZAAxAFIAcABkAEcAeABsAEsAQwBrAGcAZQB3ADAASwBJAEMAQQBnAEkAQwBSAG8AVgAyADUAawBJAEQAMABnAFcAMQBkAHAAYgBqAE0AeQBYAFQAbwA2AFIAMgBWADAAUgBtADkAeQBaAFcAZAB5AGIAMwBWAHUAWgBGAGQAcABiAG0AUgB2AGQAeQBnAHAARABRAG8AZwBJAEMAQQBnAEoASABOAGkASQBEADAAZwBUAG0AVgAzAEwAVQA5AGkAYQBtAFYAagBkAEMAQgBUAGUAWABOADAAWgBXADAAdQBWAEcAVgA0AGQAQwA1AFQAZABIAEoAcABiAG0AZABDAGQAVwBsAHMAWgBHAFYAeQBLAEQASQAxAE4AaQBrAE4AQwBpAEEAZwBJAEMAQgBiAFYAMgBsAHUATQB6AEoAZABPAGoAcABIAFoAWABSAFgAYQBXADUAawBiADMAZABVAFoAWABoADAASwBDAFIAbwBWADIANQBrAEwAQwBBAGsAYwAyAEkAcwBJAEMAUgB6AFkAaQA1AEQAWQBYAEIAaABZADIAbAAwAGUAUwBrAGcAZgBDAEIAUABkAFgAUQB0AFQAbgBWAHMAYgBBADAASwBJAEMAQQBnAEkASABKAGwAZABIAFYAeQBiAGkAQQBrAGMAMgBJAHUAVgBHADkAVABkAEgASgBwAGIAbQBjAG8ASwBRADAASwBmAFEAMABLAFoAbgBWAHUAWQAzAFIAcABiADIANABnAFMARwBsAGsAWgBVAEYAagBkAEcAbAAyAFoAVgBkAHAAYgBtAFIAdgBkAHkAZwBwAEkASABzAE4AQwBpAEEAZwBJAEMAQQBrAGEARgBkAHUAWgBDAEEAOQBJAEYAdABYAGEAVwA0AHoATQBsADAANgBPAGsAZABsAGQARQBaAHYAYwBtAFYAbgBjAG0AOQAxAGIAbQBSAFgAYQBXADUAawBiADMAYwBvAEsAUQAwAEsASQBDAEEAZwBJAEYAdABYAGEAVwA0AHoATQBsADAANgBPAGwATgBvAGIAMwBkAFgAYQBXADUAawBiADMAYwBvAEoARwBoAFgAYgBtAFEAcwBJAEQAQQBwAEQAUQBwADkARABRAG8AawBZADMAVgB5AGMAbQBWAHUAZABGAGQAcABiAG0AUgB2AGQAMQBSAHAAZABHAHgAbABJAEQAMABnAFIAMgBWADAAUQBXAE4AMABhAFgAWgBsAFYAMgBsAHUAWgBHADkAMwBWAEcAbAAwAGIARwBVAE4AQwBrAGgAcABaAEcAVgBCAFkAMwBSAHAAZABtAFYAWABhAFcANQBrAGIAMwBjAE4AQwBnAD0APQAiAH0AJwAgAHwAIABDAG8AbgB2AGUAcgB0AEYAcgBvAG0ALQBKAHMAbwBuACkALgBTAGMAcgBpAHAAdAApACkAIAB8ACAAaQBlAHgA
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4388
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zy5t2zg5\zy5t2zg5.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4384
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1018.tmp" "c:\Users\Admin\AppData\Local\Temp\zy5t2zg5\CSC84E63A83DCA54FD3A60F7E18FF36FCD.TMP"
      4⤵
      PID:2024
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get uuid /value
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES1018.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES1018.tmp
Size 1KB
SHA256 01c55b4028ecd804d1e7bb248f7fbc742badf4cdd8f8bc60e935efcf8b47f1ad
MD5 a782df43bcad2a9670f1200f1357feab
SHA1 66ff37e56edc6bcf07da2c422a9f7f8fe4724504
SHA512 6a81b8aa53ba2c26f61ee77d91f22b4f55b447502eaf154236f5a1d1c8daf30cf3b175ca55c2baada5ceaef57f1fb74a4799e98e8ebe2a853649611e0e998eb5
TLSH
T10621890593EC4B1EF0734731B9F6572FA264FE94EFA1975A8541422C2851504EEA1B72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_zlsdp25y.2dr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zlsdp25y.2dr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

zy5t2zg5.dll

Path C:\Users\Admin\AppData\Local\Temp\zy5t2zg5\zy5t2zg5.dll
Size 3KB
SHA256 49dcded8eb18f12a7d55bd8d141287b547c1a88ed1121327c60241e34c9dfaa5
MD5 1cb157f0baad66f021c8ca736db3b008
SHA1 ace47c9c93b09c56855ae004a22377de21ef4485
SHA512 1f6cd552b246697d5cce63e500818525d60bd60c875353b4eec5ddd992ddfeaee2684a42bdd306a9b9fe01c8477bbfde857a612819e544a9e5fae5ce6910126a
TLSH
T1D751FF0693E8462BF4B74734EDF3432663A4FC509B72975E0981422DFC612244E32FB5
MD5 SHA1 SHA512 TLSH

Submit Download

CSC84E63A83DCA54FD3A60F7E18FF36FCD.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\zy5t2zg5\CSC84E63A83DCA54FD3A60F7E18FF36FCD.TMP
Size 652B
SHA256 88b603cddb85a2b08fa4a3068869ec0448b7e7519f434bc937798d0db33c8342
MD5 f5b2a786f92817c65f2f829cbf8deb46
SHA1 ef3625b62ae24bca41057b28113fa52f06cb2623
SHA512 eea188069049fa23b20daba717e2eb6a2fff937beb16149e574fdede7dfc9d4ce3f9661d17d0d32f706d534cf59d36d13da5c6b1cb9330a9222ccd8e2d64158a
TLSH
T13FF05E0A63F8020EF4F35B30BDF68367D1A8BC64DE32D3ED1581531D28645149962FB6
MD5 SHA1 SHA512 TLSH

Submit Download

zy5t2zg5.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\zy5t2zg5\zy5t2zg5.0.cs
Size 353B
SHA256 2c058658252d0f5a4613dc846d56329797e86033e3c61b9b68537ae167000072
MD5 379570600f5439dda873eda8f0ce4a79
SHA1 2023b772101aff5b12ab53f24a69742a4b9c394f
SHA512 70ad464f11597e9677a757c59a79a27650487d0f59cbb35d88e9775236e2dbf3cb78413b10eac3e9a33e2cba7fb1fb85ef7755b1d25e1c7d9513615ea4daf152
TLSH
T1F6E026A86603A9614432040A5C41E5FCF30B0033267E1A00B6BD0331DF3B0199234F1C
MD5 SHA1 SHA512 TLSH

Submit Download

zy5t2zg5.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\zy5t2zg5\zy5t2zg5.cmdline
Size 369B
SHA256 3defb38cd6a42953201ee5c5a486229b3d7f721e5ad2035d100a794d1b53b6d9
MD5 a9023445a930fa11f73bf1a718fd0316
SHA1 ac21283e0bb0fc8f8a40e000680bef61da2c6cd2
SHA512 0cce2769df054fd182b02596c6a7c0162d91ec77dca480b81433f53414fddd4adbeaea2e5458508e1ba44a8daf30cdb677cf6ec8a7591a4ede9ffe3508a76b34
TLSH
T119E0C03A4246C2BE11DD1807366BDABCC2F2078369483F845060441DF01700827F3761
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4388-3-0x000001BD7A9E0000-0x000001BD7A9F0000-memory.dmp

Download

memory/4388-2-0x000001BD7A9E0000-0x000001BD7A9F0000-memory.dmp

Download

memory/4388-5-0x000001BD7D6E0000-0x000001BD7D702000-memory.dmp

Download

memory/4388-12-0x000001BD7DD30000-0x000001BD7DEF2000-memory.dmp

Download

memory/4388-13-0x000001BD7E430000-0x000001BD7E958000-memory.dmp

Download

memory/4388-26-0x000001BD7D9C0000-0x000001BD7D9C8000-memory.dmp

Download