Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
04/06/2026, 00:38
General
- Target 2026-06-04_52bdcc68d4810e0d4b83c931811cf9b7_akira_bazarloader_cobalt-strike_coinminer_glassworm_hell.exe
- Size 89.4MB
- Sample260604-azksbaf18x
- SHA256 6e78b6c9c4db094116d0b66ba7a6345aa68fad01aee57e4ab4f85bcb88e7f338
Malware Config
Signatures
- Detects executables packed with Enigma 5 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
- Loads dropped DLL 5 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-04_52bdcc68d4810e0d4b83c931811cf9b7_akira_bazarloader_cobalt-strike_coinminer_glassworm_hell.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-04_52bdcc68d4810e0d4b83c931811cf9b7_akira_bazarloader_cobalt-strike_coinminer_glassworm_hell.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c wmic baseboard get serialnumber 2>nul2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get serialnumber3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-CimInstance Win32_BaseBoard).SerialNumber"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c wmic cpu get processorid 2>nul2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get processorid3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-CimInstance Win32_Processor).ProcessorId"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance Win32_NetworkAdapter | Where-Object { $_.PhysicalAdapter -eq $true -and $_.MACAddress -ne $null } | Select-Object -ExpandProperty MACAddress"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_lnmy1pcx.s20.ps1
evb5139.tmp
evb5745.tmp
evb5A43.tmp
evb5A54.tmp
evb7D8D.tmp
memory/3020-36-0x0000000180000000-0x00000001846D8000-memory.dmp
memory/3020-1-0x00007FFE35B64000-0x00007FFE35B65000-memory.dmp
memory/3020-28-0x0000000003BF0000-0x0000000003CD0000-memory.dmp
memory/3020-30-0x0000000003BF0000-0x0000000003CD0000-memory.dmp
memory/3020-34-0x0000000003BF0000-0x0000000003CD0000-memory.dmp
memory/3020-15-0x0000000002920000-0x0000000003BF0000-memory.dmp
memory/3020-17-0x0000000002920000-0x0000000003BF0000-memory.dmp
memory/3020-47-0x0000000003CD0000-0x0000000005234000-memory.dmp
memory/3020-40-0x0000000002920000-0x0000000003BF0000-memory.dmp
memory/3020-55-0x0000000005240000-0x00000000052FB000-memory.dmp
memory/3020-53-0x0000000005240000-0x00000000052FB000-memory.dmp
memory/3020-10-0x0000000180000000-0x00000001846D8000-memory.dmp
memory/3020-35-0x0000000003CD0000-0x0000000005234000-memory.dmp
memory/3020-0-0x0000000140000000-0x0000000140202000-memory.dmp
memory/3020-184-0x0000000180000000-0x00000001846D8000-memory.dmp
memory/3020-6-0x0000000180000000-0x00000001846D8000-memory.dmp
memory/3020-183-0x0000000140000000-0x0000000140202000-memory.dmp
memory/3020-129-0x0000000140000000-0x0000000140202000-memory.dmp
memory/3020-116-0x00007FFE35AC0000-0x00007FFE35CC9000-memory.dmp
memory/3020-113-0x0000000003CD0000-0x0000000005234000-memory.dmp
memory/3020-115-0x00007FFE35AC0000-0x00007FFE35CC9000-memory.dmp
memory/3020-5-0x00007FFE35AC0000-0x00007FFE35CC9000-memory.dmp
memory/3020-4-0x00007FFE35AC0000-0x00007FFE35CC9000-memory.dmp
memory/3020-114-0x0000000005240000-0x00000000052FB000-memory.dmp
memory/3020-92-0x0000000140000000-0x0000000140202000-memory.dmp
memory/3020-23-0x0000000002920000-0x0000000003BF0000-memory.dmp
memory/3020-101-0x00007FFE35AC0000-0x00007FFE35CC9000-memory.dmp
memory/3020-109-0x0000000140000000-0x0000000140202000-memory.dmp
memory/3336-91-0x0000021A79AC0000-0x0000021A79B73000-memory.dmp
memory/4572-74-0x0000019CFC8C0000-0x0000019CFC8E4000-memory.dmp
memory/4572-73-0x0000019CFC8C0000-0x0000019CFC8EA000-memory.dmp
memory/4572-72-0x0000019CFC880000-0x0000019CFC88A000-memory.dmp
memory/4572-71-0x0000019CFC7C0000-0x0000019CFC873000-memory.dmp
memory/4572-70-0x0000019CFC7A0000-0x0000019CFC7BC000-memory.dmp
memory/4572-57-0x0000019CFC6E0000-0x0000019CFC702000-memory.dmp