Analysis
- max time kernel
149s - max time network
131s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/06/2026, 16:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-04_c04d9ccb83717fc15fa97b563de1b8a7_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-04_c04d9ccb83717fc15fa97b563de1b8a7_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Resource
win11-20260513-en
2 signatures
150 seconds
General
- Target 2026-06-04_c04d9ccb83717fc15fa97b563de1b8a7_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
- Size 68.2MB
- Sample260604-vdkweaa171
- SHA256 f1797fe33005964c8962ff1e0f0e4f8f1c0d286ffd511554095bc75f0921e3fc
- MD5 c04d9ccb83717fc15fa97b563de1b8a7
- SHA1 e96d6e673e4b5b18f09f3565ac984817d1900d8b
- SHA512 1382dea69134a97af711217ebe99a91098ff8e7f41cd2faaa673793b23cfd8c495b0d9d26fea6b38d668b0070d428ae301ddcf3bba495d7f3c10443b0ef08a39
- SSDEEP 393216:Gn1XQgPR2k3m5C507G9ITEc5eAlkLbQurxMWhAsIyNOPS0B4AycWsCYaxFzwW/ty:G1XR7AsxYqt2oRGj5rs3wb8/
- TLSH T10EF7594262EA04C4F9F7DA359AE65217D673BC166F3081CF325C172A1F736E08976B22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 3752 2026-06-04_c04d9ccb83717fc15fa97b563de1b8a7_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3752 2026-06-04_c04d9ccb83717fc15fa97b563de1b8a7_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe 3752 2026-06-04_c04d9ccb83717fc15fa97b563de1b8a7_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-04_c04d9ccb83717fc15fa97b563de1b8a7_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-04_c04d9ccb83717fc15fa97b563de1b8a7_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3752
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\8dwjer4piqt1nhqz.node
- Size 264KB
- SHA256 d02f120e5ec1ade910f55391776a7447a0661067411a72009387ddd68dd12733
- MD5 097aadc0d81ef139ef422d70f9ea7961
- SHA1 07afec7288e7569319e8b12ef21451f0c4f54e27
- SHA512 cd4b4be454bd7b7351933329ab503c7742a3a71be71a917688eee8e14856ae63d9eb358a728a1a40143c4818e6228ee8ea6584b466cecb144ba1f86fa87784a6
- SSDEEP 6144:5M18/aZt3o96Z4BV0wPTWl4gXYq91JQzhnlHBVo1Tq:C18/S3NZ4/yl59SFlno1+
- TLSH T17F44AE0BB3A500BBE1778679C9531A02E77678151760ABDF03A0477D2F633D1AE3AB61
- MD5 SHA1 SHA512 SSDEEP TLSH