Analysis
- max time kernel
148s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
09/07/2026, 00:52
General
- Target 2026-07-08_200f69d6ed866649a430af430603b66f_akira_bazarloader_cobalt-strike_coinminer_glassworm_hell.exe
- Size 89.5MB
- Sample260709-a8cs3abs3q
- SHA256 57d2049d0019ec2ad03623fc15a3e6472a37097126b33388c26eaecf626149ef
Malware Config
Signatures
- Detects executables packed with Enigma 4 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Loads dropped DLL 5 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-08_200f69d6ed866649a430af430603b66f_akira_bazarloader_cobalt-strike_coinminer_glassworm_hell.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-08_200f69d6ed866649a430af430603b66f_akira_bazarloader_cobalt-strike_coinminer_glassworm_hell.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-CimInstance Win32_DiskDrive | Where-Object { $_.Index -eq 0 }).SerialNumber"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_20siamqg.bk4.ps1
evb5A90.tmp
evb6195.tmp
evb639A.tmp
evb63BA.tmp
evb78DA.tmp
memory/3340-34-0x0000000003D00000-0x0000000005264000-memory.dmp
memory/3340-5-0x00007FFB37850000-0x00007FFB37A45000-memory.dmp
memory/3340-20-0x0000000002950000-0x0000000003C20000-memory.dmp
memory/3340-6-0x0000000180000000-0x00000001846D8000-memory.dmp
memory/3340-33-0x0000000003C20000-0x0000000003D00000-memory.dmp
memory/3340-29-0x0000000003C20000-0x0000000003D00000-memory.dmp
memory/3340-27-0x0000000003C20000-0x0000000003D00000-memory.dmp
memory/3340-4-0x00007FFB37850000-0x00007FFB37A45000-memory.dmp
memory/3340-16-0x0000000002950000-0x0000000003C20000-memory.dmp
memory/3340-40-0x0000000003D00000-0x0000000005264000-memory.dmp
memory/3340-0-0x0000000140000000-0x0000000140207000-memory.dmp
memory/3340-50-0x0000000002250000-0x000000000230B000-memory.dmp
memory/3340-48-0x0000000002250000-0x000000000230B000-memory.dmp
memory/3340-14-0x0000000002950000-0x0000000003C20000-memory.dmp
memory/3340-1-0x00007FFB378ED000-0x00007FFB378EE000-memory.dmp
memory/3340-90-0x0000000140000000-0x0000000140207000-memory.dmp
memory/3340-60-0x0000000140000000-0x0000000140207000-memory.dmp
memory/3340-72-0x0000000140000000-0x0000000140207000-memory.dmp
memory/3340-66-0x0000000003D00000-0x0000000005264000-memory.dmp
memory/3340-64-0x0000000002950000-0x0000000003C20000-memory.dmp
memory/3340-67-0x0000000002250000-0x000000000230B000-memory.dmp
memory/3340-71-0x00007FFB37850000-0x00007FFB37A45000-memory.dmp
memory/3340-61-0x0000000180000000-0x00000001846D8000-memory.dmp
memory/4636-62-0x0000023171C40000-0x0000023171C6A000-memory.dmp
memory/4636-70-0x00000231740C0000-0x00000231742DC000-memory.dmp
memory/4636-63-0x0000023171C40000-0x0000023171C64000-memory.dmp
memory/4636-54-0x0000023171C10000-0x0000023171C32000-memory.dmp