e2fdccae78b734f3f25504fbb388d846077ce910befa5a13ca08948f5e4e9592

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/07/2026, 01:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_ca5f099b29a3908a8f45651f60512559_akira_cobalt-strike_coinminer_glassworm_rusty-stealer_satacom_vidar.exe
Size 12.9MB
Sample260713-bpswlscy6t
SHA256 e2fdccae78b734f3f25504fbb388d846077ce910befa5a13ca08948f5e4e9592
MD5 ca5f099b29a3908a8f45651f60512559
SHA1 b4bb93d93be93d6f1f4ffe9785cdfe64e247078d
SHA512 f8c2616deb49e2a7c650dfed81984eb8ad2d85deaa6b8ca11e6e488784fa9c3b5383c68b73c0034c4163cec71afa2ac22611554c0dc0f9f69516cf7521b4386e
SSDEEP 196608:YjxaaIvDip9k0W48C1uWWm3SR41euQ4oa+DAN:YEami64JUWWmCLb4XH
TLSH
T130D64C03F67251DEC5FAC038962A7323F9B07CDD8634A76B469096622F71B24AE3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3284	EdgSvcs.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
9	api.ipify.org
9	ip-api.com
12	api.ipify.org

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
2500	wmic.exe
2500	wmic.exe
2500	wmic.exe
2500	wmic.exe
4748	wmic.exe
4748	wmic.exe
4748	wmic.exe
4748	wmic.exe
1168	wmic.exe
1168	wmic.exe
1168	wmic.exe
1168	wmic.exe
2608	wmic.exe
2608	wmic.exe
2608	wmic.exe
2608	wmic.exe
3552	wmic.exe
3552	wmic.exe
3552	wmic.exe
3552	wmic.exe
632	wmic.exe
632	wmic.exe
632	wmic.exe
632	wmic.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2500	wmic.exe
Token: SeSecurityPrivilege	2500	wmic.exe
Token: SeTakeOwnershipPrivilege	2500	wmic.exe
Token: SeLoadDriverPrivilege	2500	wmic.exe
Token: SeSystemProfilePrivilege	2500	wmic.exe
Token: SeSystemtimePrivilege	2500	wmic.exe
Token: SeProfSingleProcessPrivilege	2500	wmic.exe
Token: SeIncBasePriorityPrivilege	2500	wmic.exe
Token: SeCreatePagefilePrivilege	2500	wmic.exe
Token: SeBackupPrivilege	2500	wmic.exe
Token: SeRestorePrivilege	2500	wmic.exe
Token: SeShutdownPrivilege	2500	wmic.exe
Token: SeDebugPrivilege	2500	wmic.exe
Token: SeSystemEnvironmentPrivilege	2500	wmic.exe
Token: SeRemoteShutdownPrivilege	2500	wmic.exe
Token: SeUndockPrivilege	2500	wmic.exe
Token: SeManageVolumePrivilege	2500	wmic.exe
Token: 33	2500	wmic.exe
Token: 34	2500	wmic.exe
Token: 35	2500	wmic.exe
Token: 36	2500	wmic.exe
Token: SeIncreaseQuotaPrivilege	2500	wmic.exe
Token: SeSecurityPrivilege	2500	wmic.exe
Token: SeTakeOwnershipPrivilege	2500	wmic.exe
Token: SeLoadDriverPrivilege	2500	wmic.exe
Token: SeSystemProfilePrivilege	2500	wmic.exe
Token: SeSystemtimePrivilege	2500	wmic.exe
Token: SeProfSingleProcessPrivilege	2500	wmic.exe
Token: SeIncBasePriorityPrivilege	2500	wmic.exe
Token: SeCreatePagefilePrivilege	2500	wmic.exe
Token: SeBackupPrivilege	2500	wmic.exe
Token: SeRestorePrivilege	2500	wmic.exe
Token: SeShutdownPrivilege	2500	wmic.exe
Token: SeDebugPrivilege	2500	wmic.exe
Token: SeSystemEnvironmentPrivilege	2500	wmic.exe
Token: SeRemoteShutdownPrivilege	2500	wmic.exe
Token: SeUndockPrivilege	2500	wmic.exe
Token: SeManageVolumePrivilege	2500	wmic.exe
Token: 33	2500	wmic.exe
Token: 34	2500	wmic.exe
Token: 35	2500	wmic.exe
Token: 36	2500	wmic.exe
Token: SeIncreaseQuotaPrivilege	4748	wmic.exe
Token: SeSecurityPrivilege	4748	wmic.exe
Token: SeTakeOwnershipPrivilege	4748	wmic.exe
Token: SeLoadDriverPrivilege	4748	wmic.exe
Token: SeSystemProfilePrivilege	4748	wmic.exe
Token: SeSystemtimePrivilege	4748	wmic.exe
Token: SeProfSingleProcessPrivilege	4748	wmic.exe
Token: SeIncBasePriorityPrivilege	4748	wmic.exe
Token: SeCreatePagefilePrivilege	4748	wmic.exe
Token: SeBackupPrivilege	4748	wmic.exe
Token: SeRestorePrivilege	4748	wmic.exe
Token: SeShutdownPrivilege	4748	wmic.exe
Token: SeDebugPrivilege	4748	wmic.exe
Token: SeSystemEnvironmentPrivilege	4748	wmic.exe
Token: SeRemoteShutdownPrivilege	4748	wmic.exe
Token: SeUndockPrivilege	4748	wmic.exe
Token: SeManageVolumePrivilege	4748	wmic.exe
Token: 33	4748	wmic.exe
Token: 34	4748	wmic.exe
Token: 35	4748	wmic.exe
Token: 36	4748	wmic.exe
Token: SeIncreaseQuotaPrivilege	4748	wmic.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 4324	4944	2026-07-12_ca5f099b29a3908a8f45651f60512559_akira_cobalt-strike_coinminer_glassworm_rusty-stealer_satacom_vidar.exe	87
PID 4944 wrote to memory of 3284	4944	2026-07-12_ca5f099b29a3908a8f45651f60512559_akira_cobalt-strike_coinminer_glassworm_rusty-stealer_satacom_vidar.exe	89
PID 4944 wrote to memory of 1580	4944	2026-07-12_ca5f099b29a3908a8f45651f60512559_akira_cobalt-strike_coinminer_glassworm_rusty-stealer_satacom_vidar.exe	92
PID 4944 wrote to memory of 2500	4944	2026-07-12_ca5f099b29a3908a8f45651f60512559_akira_cobalt-strike_coinminer_glassworm_rusty-stealer_satacom_vidar.exe	94
PID 4944 wrote to memory of 4748	4944	2026-07-12_ca5f099b29a3908a8f45651f60512559_akira_cobalt-strike_coinminer_glassworm_rusty-stealer_satacom_vidar.exe	97
PID 4944 wrote to memory of 1168	4944	2026-07-12_ca5f099b29a3908a8f45651f60512559_akira_cobalt-strike_coinminer_glassworm_rusty-stealer_satacom_vidar.exe	99
PID 4944 wrote to memory of 2608	4944	2026-07-12_ca5f099b29a3908a8f45651f60512559_akira_cobalt-strike_coinminer_glassworm_rusty-stealer_satacom_vidar.exe	101
PID 4944 wrote to memory of 3552	4944	2026-07-12_ca5f099b29a3908a8f45651f60512559_akira_cobalt-strike_coinminer_glassworm_rusty-stealer_satacom_vidar.exe	103
PID 4944 wrote to memory of 632	4944	2026-07-12_ca5f099b29a3908a8f45651f60512559_akira_cobalt-strike_coinminer_glassworm_rusty-stealer_satacom_vidar.exe	105

C:\Users\Admin\AppData\Local\Temp\2026-07-12_ca5f099b29a3908a8f45651f60512559_akira_cobalt-strike_coinminer_glassworm_rusty-stealer_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_ca5f099b29a3908a8f45651f60512559_akira_cobalt-strike_coinminer_glassworm_rusty-stealer_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Windows\system32\cmd.exe
  "cmd" /c "vol C:"
  2⤵
  PID:4324
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\Providers\EdgSvcs.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\Providers\EdgSvcs.exe" -f C:\Users\Admin\AppData\Local\Temp\ws_tor_data\torrc --DataDirectory \\?\C:\Users\Admin\AppData\Local\Temp\ws_tor_data
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\system32\cmd.exe
  "cmd" /c "vol C:"
  2⤵
  PID:1580
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" os get Caption
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2500
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" os get Caption
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4748
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" cpu get Name
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1168
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" computersystem get totalphysicalmemory
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2608
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" computersystem get Manufacturer,Model
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3552
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" computersystem get Manufacturer,Model
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cached-microdesc-consensus

Path C:\Users\Admin\AppData\Local\Temp\ws_tor_data\cached-microdesc-consensus
Size 3.3MB
SHA256 c6c3172143887c41c926f04b11c5c3742c7ea2b86f6da70c97c38c60713ee3a6
MD5 56bb128891c20082e469265a197fd198
SHA1 aa33f6e29bfecbd620c8d6dba0111e3c1d17bb8d
SHA512 6d2e95dac106d815484168e7f0c1977b7a51e64834e6cdff6606a49dab568194b73d7dbfcc06d4e39a90f891cb1d013cf057218678f2b8ef2020af6508b2ea9c
SSDEEP 24576:1Pb+goE4v+f0PaEIliN62PLw3PFID9Vt8:4E4vQE2i/KKt8
TLSH
T111F542EA97124EEAD32A09DBE510FF7BF33F5725C2486B94286F48FA7205091752093D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cached-microdescs.new

Path C:\Users\Admin\AppData\Local\Temp\ws_tor_data\cached-microdescs.new
Size 39.4MB
SHA256 edd07acee343a14e942e2af666235b4a845d9cf16e2631f5b00396a83a970cfe
MD5 99be565d8e1127d2f5a6742930ce2576
SHA1 f8b65701c887cb813a913bed4716dc09532d6718
SHA512 cd3b950b5531691feeba9cf997ac4b406b64935b677255ce963d80395180cd4ab77da8f0555e3b17627ec54fdd51bdc6a7b338a2478c4fb7a9d87317561dca19
SSDEEP 24576:Cx5VkpP0NdtVoVuzV/VKVlVaVoHVWeV6+V+VAwVtXViVNVUgqVtDEVWVnKD1EE2b:Mn2iRtoZb3cFcpGcnw5AIEAApfhao47
TLSH
T1BA97AEDA499B04C15E05E7CDEC2607C3DF108A3A4B6041A176AAF5677F332AFC15EA78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hostname

Path C:\Users\Admin\AppData\Local\Temp\ws_tor_data\proxy_hs\hostname
Size 64B
SHA256 3f8827dbe9ea4bc708234c0e17f749f45aeb5d1c8582073a349ef60a5e703b74
MD5 ffd157ee784f11d188fbb29b71a56e99
SHA1 a13dd5634a6e9b8248b25855b6837d544ae605c1
SHA512 10bd09970bb9474b7a3ace8c756eeacb2b964fd896ee5dbb65e67d8066f8adb3d40869de288d96da9330b860413ea7d8c2f32c60ceb7663e7e52d8fe07f78f6d
TLSH
T156A00261ED66DC39C549C68F5A8E930BC22348827626800371A9AE9A41613659541565
MD5 SHA1 SHA512 TLSH

Submit Download

torrc

Path C:\Users\Admin\AppData\Local\Temp\ws_tor_data\torrc
Size 299B
SHA256 12003cff020b7689e3050193a17bfed658a72e24f1c1575ad6a70d6574f48787
MD5 5bdb6dd39d528a5691b8f485753a79cf
SHA1 ad56c68d2c0a2e1d1b105f8a06b5b6332fcefd65
SHA512 b1f33ed1bd549504f6ab930cec7e05a67d24622d5e4b8e47abb4db9a9b54be29171a85dd2189dd71eacacfe5aabb18706f843cc0d394749fdd08b4b5c4584459
TLSH
T1D7E07D1031CD9B6B084E430B1571E0CDC2B2A4D91D9C3D184B51B9046CD900FDE83200
MD5 SHA1 SHA512 TLSH

Submit Download

EdgSvcs.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\Providers\EdgSvcs.exe
Size 8.6MB
SHA256 fe6d44cb69780e09c3a39f499e0e668bff9aa54b6cd9f363b753d59af713bea0
MD5 c6c5138498c7f677e3f0d58dca7295e1
SHA1 b898d01e8309f67573fbd6073d86450a083dfcfd
SHA512 40bd3ad1b36012c0f4714ddf936a026555ac7002a2ab60fe978f3cc14573368eab9ed7b32621867e041350095a1b26c6eaaa4bda49ce72a0328f8f2e85a16203
SSDEEP 98304:tQPsk0W4Z0jC7e98qVWW3Zkj+NDBPnU3Wx3+2BC1euDMwzUul/8447W6y:t9k0W48C1uWWm3SR41euQ4o
TLSH
T1F896FB03E63361DEC5FAC139952A7323F8B03CDD8A35E767455092A22B74B64AE3DB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download