744ffcf61bd9a69dfe0109a4b98d5524a18d7434a4e69122dc27eeff7a8fd571

Analysis

max time kernel
150s
max time network
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 04:26

Target
2026-07-11_7f80f98c57fe251a2f95ed9a4a25f085_akira_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc.exe
Size 10.7MB
Sample260711-e2w1ksdx8t
SHA256 744ffcf61bd9a69dfe0109a4b98d5524a18d7434a4e69122dc27eeff7a8fd571
MD5 7f80f98c57fe251a2f95ed9a4a25f085
SHA1 e3d4edef9a48b5ee79182be449a935d7da0cd802
SHA512 3e1597624e5cbc3988cad5f03f5620d08e4e4b86aa8647abcfc652b46f7c0e0353e97628e80a910a297ddb00363159430f3180c13660b91dc189d9f294307ada
SSDEEP 196608:8/6mANWLTITpZIG271Mn4OmnLTyGdUYib2gcqLbeNpwvUGNbxnK:8HIW3ITpZIG271Mn4RnLTyGdUYiSgc5+
TLSH
T19FB6AE57B7AC00D4E41681B8838A12F3D772FC79177016CB9A644AB61F73AD81EBB352
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6040	2026-07-11_7f80f98c57fe251a2f95ed9a4a25f085_akira_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc.exe
6040	2026-07-11_7f80f98c57fe251a2f95ed9a4a25f085_akira_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2076	2026-07-11_7f80f98c57fe251a2f95ed9a4a25f085_akira_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6040 wrote to memory of 2076	6040	2026-07-11_7f80f98c57fe251a2f95ed9a4a25f085_akira_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-11_7f80f98c57fe251a2f95ed9a4a25f085_akira_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_7f80f98c57fe251a2f95ed9a4a25f085_akira_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6040
- C:\Users\Admin\AppData\Local\Temp\2026-07-11_7f80f98c57fe251a2f95ed9a4a25f085_akira_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-11_7f80f98c57fe251a2f95ed9a4a25f085_akira_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc.exe"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2076