Analysis
- max time kernel
149s - max time network
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
09/07/2026, 00:52
General
- Target 2026-07-08_200f69d6ed866649a430af430603b66f_akira_bazarloader_cobalt-strike_coinminer_glassworm_hell.exe
- Size 89.5MB
- Sample260709-a8cs3abs3q
- SHA256 57d2049d0019ec2ad03623fc15a3e6472a37097126b33388c26eaecf626149ef
Malware Config
Signatures
- Detects executables packed with Enigma 4 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Loads dropped DLL 5 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-08_200f69d6ed866649a430af430603b66f_akira_bazarloader_cobalt-strike_coinminer_glassworm_hell.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-08_200f69d6ed866649a430af430603b66f_akira_bazarloader_cobalt-strike_coinminer_glassworm_hell.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-CimInstance Win32_DiskDrive | Where-Object { $_.Index -eq 0 }).SerialNumber"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
evbA8AB.tmp
evbAD4F.tmp
evbAFD1.tmp
evbB159.tmp
evbB244.tmp
memory/1472-59-0x000001B5A88C0000-0x000001B5A88EA000-memory.dmp
memory/1472-60-0x000001B5A88C0000-0x000001B5A88E4000-memory.dmp
memory/1472-58-0x000001B5A8440000-0x000001B5A844A000-memory.dmp
memory/1472-57-0x000001B5A86B0000-0x000001B5A8762000-memory.dmp
memory/1472-56-0x000001B5A8450000-0x000001B5A846E000-memory.dmp
memory/1472-53-0x000001B590290000-0x000001B5902B2000-memory.dmp
memory/5856-47-0x00000000024D0000-0x000000000258B000-memory.dmp
memory/5856-3-0x00007FFFF6AA0000-0x00007FFFF6D03000-memory.dmp
memory/5856-33-0x00000000048C0000-0x0000000005E24000-memory.dmp
memory/5856-39-0x00000000048C0000-0x0000000005E24000-memory.dmp
memory/5856-49-0x00000000024D0000-0x000000000258B000-memory.dmp
memory/5856-0-0x0000000140000000-0x0000000140207000-memory.dmp
memory/5856-28-0x0000000002360000-0x0000000002440000-memory.dmp
memory/5856-27-0x0000000002360000-0x0000000002440000-memory.dmp
memory/5856-24-0x00000000035F0000-0x00000000048C0000-memory.dmp
memory/5856-18-0x00000000035F0000-0x00000000048C0000-memory.dmp
memory/5856-5-0x0000000180000000-0x00000001846D8000-memory.dmp
memory/5856-32-0x0000000002360000-0x0000000002440000-memory.dmp
memory/5856-1-0x00007FFFF6BFF000-0x00007FFFF6C00000-memory.dmp
memory/5856-67-0x00000000024D0000-0x000000000258B000-memory.dmp
memory/5856-62-0x0000000140000000-0x0000000140207000-memory.dmp
memory/5856-64-0x00000000035F0000-0x00000000048C0000-memory.dmp
memory/5856-66-0x00000000048C0000-0x0000000005E24000-memory.dmp
memory/5856-68-0x00007FFFF6AA0000-0x00007FFFF6D03000-memory.dmp
memory/5856-63-0x0000000180000000-0x00000001846D8000-memory.dmp
memory/5856-81-0x0000000140000000-0x0000000140207000-memory.dmp
memory/5856-141-0x0000000140000000-0x0000000140207000-memory.dmp
memory/5856-142-0x0000000180000000-0x00000001846D8000-memory.dmp