5e0568215d4e4706a4f8f1119c3d7c22fd92cd58f02ca3feafabbc14a045a779

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 02:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_c641f3b795a2be3c54ecdb858c1447f1_akira_cobalt-strike.exe
Size 744KB
Sample260720-c3e3caft9w
SHA256 5e0568215d4e4706a4f8f1119c3d7c22fd92cd58f02ca3feafabbc14a045a779
MD5 c641f3b795a2be3c54ecdb858c1447f1
SHA1 beba937bd3a0f3544474222f6acbe242b98c718b
SHA512 837625b97d78a44633f4b4a304e973bfdaf51a2e05c4316cbefb4688fe7842c512f557f48ff644d35a354724e15eea18c48c3c901bf367438ee4cf5aefd11c0d
SSDEEP 12288:Nf6waOlHsrzs+RA8Nm7PU2zrxIy2+J1jf65MQAAHg5jy6l7nb1GvnbQ7YqO:Ywagsk6IU2xIyDTT65Dg5W6F5sY
TLSH
T17FF4BEFE6574B5A9C245CCF5F206B372A533BC464E20687F02ECB6242E3E951EA18735
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion spyware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5320	runtime_host.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runtime_host.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	runtime_host.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	runtime_host.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	runtime_host.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	runtime_host.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	runtime_host.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	runtime_host.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	runtime_host.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	runtime_host.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	runtime_host.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	runtime_host.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	runtime_host.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	runtime_host.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	runtime_host.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	runtime_host.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	runtime_host.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	runtime_host.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	runtime_host.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	runtime_host.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	runtime_host.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	runtime_host.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runtime_host.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	runtime_host.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	runtime_host.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	2026-07-20_c641f3b795a2be3c54ecdb858c1447f1_akira_cobalt-strike.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	2026-07-20_c641f3b795a2be3c54ecdb858c1447f1_akira_cobalt-strike.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 4740	4452	2026-07-20_c641f3b795a2be3c54ecdb858c1447f1_akira_cobalt-strike.exe	89
PID 4740 wrote to memory of 3512	4740	2026-07-20_c641f3b795a2be3c54ecdb858c1447f1_akira_cobalt-strike.exe	90
PID 3512 wrote to memory of 5320	3512	2026-07-20_c641f3b795a2be3c54ecdb858c1447f1_akira_cobalt-strike.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-07-20_c641f3b795a2be3c54ecdb858c1447f1_akira_cobalt-strike.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_c641f3b795a2be3c54ecdb858c1447f1_akira_cobalt-strike.exe"
1⤵
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Users\Admin\AppData\Local\Temp\2026-07-20_c641f3b795a2be3c54ecdb858c1447f1_akira_cobalt-strike.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-20_c641f3b795a2be3c54ecdb858c1447f1_akira_cobalt-strike.exe" -
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4740
- - C:\Users\Admin\AppData\Local\Temp\2026-07-20_c641f3b795a2be3c54ecdb858c1447f1_akira_cobalt-strike.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-20_c641f3b795a2be3c54ecdb858c1447f1_akira_cobalt-strike.exe" -
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3512
  - - C:\Users\Admin\AppData\Local\Microsoft\Credentials\svchost_db8\runtime_host.exe
      "C:\Users\Admin\AppData\Local\Microsoft\Credentials\svchost_db8\runtime_host.exe" -
      4⤵
      Executes dropped EXE
      Checks processor information in registry
      PID:5320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

07CEF2F654E3ED6050FFC9B6EB844250_44F84527B9D1A5107012929AC9B9BF7F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_44F84527B9D1A5107012929AC9B9BF7F
Size 2KB
SHA256 5502710f023226ec87d5a3add3a92a73b46bf785fa1fb45024067331830231c5
MD5 3ce75b3879ca2d71c1d8dfd2a6fbfb55
SHA1 8f5030ab03ec1cb45bf2205ee438a7f2431c0002
SHA512 dcc6605158565219ca5e2ab38146932784456db8648bff348197f508240a04645d7e91cf0b6e5179f4bd2ec397db848cec265dfd300b335273e470a53c8dc426
TLSH
T115412CC3CC881010884A99677FD4E77319B4F5A008C2A0A1B8C9E6D20D4EEEBF71A80D
MD5 SHA1 SHA512 TLSH

Submit Download

572BF21E454637C9F000BE1AF9B1E1A9

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\572BF21E454637C9F000BE1AF9B1E1A9
Size 1007B
SHA256 f9d96aa72450cc56fbb6caf375fd441f30eb8a0ce61fcba002774ccc7e8821fa
MD5 52b19f8f21922cca53538f99629f994e
SHA1 5d4343236535980cbc16e5e669d86978459b1306
SHA512 d16b68bc8c743d9b41cf3392b53c07d07b0d835f30d37a93b5d21e419cf573e2db8841a68a626f2541fc75537c482bb745ec65a9e9de248e2b510a904c0361f7
TLSH
T125117F1C4565237B990B1E71CCCECF93EC7693D08BC7507A1BD149048963FEE8BA9455
MD5 SHA1 SHA512 TLSH

Submit Download

A1593701BD276673B04DEC503D761A9E_E1F945BF658DCC7B1DD3A7B88D3398BA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A1593701BD276673B04DEC503D761A9E_E1F945BF658DCC7B1DD3A7B88D3398BA
Size 727B
SHA256 88bd8de3ffb7d1645de3761fbc3f814a4d6ba61002143e45a0bebddd86351a9f
MD5 44bcf4fee81f7c1a882da52858858926
SHA1 baa126a90b0fcb439a9b05351cca9f2c694de4d8
SHA512 2737b2dd91819af2cdd4e0c4263bff2f611cd6a9039d9d0f0ceebe4fdd08ebaab4fce9dedd1f3c6281b413cea50e24e5ea26db213df6077c8a868f9a626dbccc
TLSH
T11F01152948EC0CA967B38969F7F8A53D2A6459D00D8A991C5A3918411C666670A970E4
MD5 SHA1 SHA512 TLSH

Submit Download

07CEF2F654E3ED6050FFC9B6EB844250_44F84527B9D1A5107012929AC9B9BF7F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_44F84527B9D1A5107012929AC9B9BF7F
Size 484B
SHA256 3d3f6da1f8f1783f6d6f4297022457aa40287039034c575d3c7175bcf45f8a67
MD5 3e9d5cbec0a9ff80d723db110d917924
SHA1 6497e92d301b60047b9e0aefaa99c2afc2ded59b
SHA512 c4ea1f0ffd47e67633571308aee660d1c80e698673add397c382a505a4906f169bdbaf18530af0ebbeb0781f5817757cf4844d75d4acb8be63eb6394e7206cbe
TLSH
T165F0F13832EF010DF03BDC7C8AED62A3691DF12318004AB803D503496A03E00DC73391
MD5 SHA1 SHA512 TLSH

Submit Download

572BF21E454637C9F000BE1AF9B1E1A9

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\572BF21E454637C9F000BE1AF9B1E1A9
Size 304B
SHA256 69684452754d1997f1ee7db936c7bd04d10caef7f949318c729cedd2141e7fd5
MD5 b2e203a54b90a562eb38b7d091ac806c
SHA1 1d54c8392f581cf175561b6a837473ecfcd24599
SHA512 9f2708c046d4fe6cc85b22edf2940b08724ac3036d65b165b8a184cae033443796592749ae5f0634e5418f1ee058ce6f080eedaeea558734f0f57f7b032a2e3b
TLSH
T1A5E05B151BDD4F72E5624B358DB15A45ED6175137601CF1D477306480416F520D6072F
MD5 SHA1 SHA512 TLSH

Submit Download

A1593701BD276673B04DEC503D761A9E_E1F945BF658DCC7B1DD3A7B88D3398BA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A1593701BD276673B04DEC503D761A9E_E1F945BF658DCC7B1DD3A7B88D3398BA
Size 484B
SHA256 631211d08005688439c19555e27b4cae643ca5c4c8453f2fac6049d63f9b7ec0
MD5 6b869ffc878be01a98d9fec71497c4e3
SHA1 9097ab9122061950d6b594a22efa7c3dde3ba2a6
SHA512 2a9cfc226f4e3918be60fe115d348027547e09183faa02be470fa91578d1de712073ebf284307388c0902d71dd10833607fb8f886e6a8d9650e3162de2134ad5
TLSH
T163F0AB0929FD007FF5F3DE7ADFCCB56A5D2EBA02745046F1AA5106496402F44AC22536
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3512-44-0x00007FF7D9E70000-0x00007FF7D9F33000-memory.dmp

Download

memory/3512-26-0x00007FF7D9E70000-0x00007FF7D9F33000-memory.dmp

Download

memory/3512-49-0x00007FF7D9E70000-0x00007FF7D9F33000-memory.dmp

Download

memory/4452-16-0x00007FF7D9E70000-0x00007FF7D9F33000-memory.dmp

Download

memory/4452-6-0x00007FF7D9E70000-0x00007FF7D9F33000-memory.dmp

Download

memory/4452-2-0x00007FF7D9E70000-0x00007FF7D9F33000-memory.dmp

Download

memory/4452-51-0x00007FF7D9E70000-0x00007FF7D9F33000-memory.dmp

Download

memory/4740-25-0x00007FF7D9E70000-0x00007FF7D9F33000-memory.dmp

Download

memory/4740-17-0x00007FF7D9E70000-0x00007FF7D9F33000-memory.dmp

Download

memory/4740-43-0x00007FF7D9E70000-0x00007FF7D9F33000-memory.dmp

Download

memory/4740-50-0x00007FF7D9E70000-0x00007FF7D9F33000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads