ffbbd02d9b9ae7cc46c5bbb4f3e93fadc19b9ece56cca86f43103f0b18af61a7

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/07/2026, 03:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_4f76a1d44df545effd1206ecb81ea6e5_akira_cobalt-strike.exe
Size 2.0MB
Sample260714-ej3qeady5p
SHA256 ffbbd02d9b9ae7cc46c5bbb4f3e93fadc19b9ece56cca86f43103f0b18af61a7
MD5 4f76a1d44df545effd1206ecb81ea6e5
SHA1 90059ed197711daeea1a622d873f2ced8b027962
SHA512 ce0661097df0e803f331a298e7aa277621ce1d78583697edc2bbba1e6f5e0def2117eb1bd3a3b34317b8dd6110969f6567418bb330bd807a8812a35bd528b60e
SSDEEP 49152:q08FNZCbHSaRCSfU8JrfB3nV5WoqG8eUaVnD6za:l8QHd8CJrfB3nDTxD6za
TLSH
T1EFA59E52FD802EECDDD1807A82AF8639BBB976892323DB27045D5932BF5B4C58E0174D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

ransomware

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	cmd.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3552	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3080 wrote to memory of 3912	3080	2026-07-14_4f76a1d44df545effd1206ecb81ea6e5_akira_cobalt-strike.exe	88
PID 3912 wrote to memory of 3552	3912	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-14_4f76a1d44df545effd1206ecb81ea6e5_akira_cobalt-strike.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_4f76a1d44df545effd1206ecb81ea6e5_akira_cobalt-strike.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3080
- C:\Windows\system32\cmd.exe
  "cmd" /C start hello.txt
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3912
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\hello.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:3552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hello.txt

Path C:\Users\Admin\AppData\Local\Temp\hello.txt
Size 53B
SHA256 c89efd449e52b36553972029ad54e1f29eb00818ca21f2c0d54ce0d7bea66942
MD5 932c8b322ae6286c7f20041729b87578
SHA1 c249db8c712780ced53714715a89eaad83f5222d
SHA512 7876fbc3bd610150f8ea9551534da7a464ff39dcf42229f21f1a0f571744f085d0b8ea2a0ac7346a3ef6c337b4dfa602959e186e606733f3b61863698527bd3f
TLSH
T1669002E21044D5E45110978D0A45541A199D1CF59DA54207463C1956A9B10444034607
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3080-1-0x00007FF714260000-0x00007FF714424000-memory.dmp

Download