a6a212fec529fee7089373fb8b76dfc7e8ff347898f39dea4889ef0da8d3d844

General

Target
2026-07-22_771cea1309c7bff5b872373b13603cc4_akira_amadey_cobalt-strike_coinminer_darkgate_glassworm_.exe
Size 269.0MB
Sample260722-3q83rssycs
SHA256 a6a212fec529fee7089373fb8b76dfc7e8ff347898f39dea4889ef0da8d3d844
MD5 771cea1309c7bff5b872373b13603cc4
SHA1 b978dfe5813c8c307ebc02166af014b63a19945f
SHA512 10df2b3c29213c5166ebd4836638a4417bdb1803fc37d5e63cc525d98bedd648305fb0b881c609aabdd4ab7f80ace8f1a658307271e3114c0f27c32f400f450b
SSDEEP 1572864:dMoCm/0XwFgZv2JvUyNumKE2kszAHi4ytP63QDyQUyNuGg9m9A:q40XwkexHi4ytP63QOMi
TLSH
T10DD80A96910D0879E3FFE67074664B67E662791333ECAC52FE08670407EA3723A78746
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
5964	2026-07-22_771cea1309c7bff5b872373b13603cc4_akira_amadey_cobalt-strike_coinminer_darkgate_glassworm_.exe
5964	2026-07-22_771cea1309c7bff5b872373b13603cc4_akira_amadey_cobalt-strike_coinminer_darkgate_glassworm_.exe
5964	2026-07-22_771cea1309c7bff5b872373b13603cc4_akira_amadey_cobalt-strike_coinminer_darkgate_glassworm_.exe
5964	2026-07-22_771cea1309c7bff5b872373b13603cc4_akira_amadey_cobalt-strike_coinminer_darkgate_glassworm_.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 4 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1448	cmd.exe
3352	cmd.exe
4088	cmd.exe
2472	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5964 wrote to memory of 1448	5964	2026-07-22_771cea1309c7bff5b872373b13603cc4_akira_amadey_cobalt-strike_coinminer_darkgate_glassworm_.exe	90
PID 1448 wrote to memory of 4828	1448	cmd.exe	91
PID 5964 wrote to memory of 3352	5964	2026-07-22_771cea1309c7bff5b872373b13603cc4_akira_amadey_cobalt-strike_coinminer_darkgate_glassworm_.exe	92
PID 3352 wrote to memory of 2996	3352	cmd.exe	93
PID 5964 wrote to memory of 4088	5964	2026-07-22_771cea1309c7bff5b872373b13603cc4_akira_amadey_cobalt-strike_coinminer_darkgate_glassworm_.exe	94
PID 4088 wrote to memory of 2732	4088	cmd.exe	95
PID 5964 wrote to memory of 2472	5964	2026-07-22_771cea1309c7bff5b872373b13603cc4_akira_amadey_cobalt-strike_coinminer_darkgate_glassworm_.exe	96
PID 2472 wrote to memory of 952	2472	cmd.exe	97

Views/modifies file attributes 1 TTPs 4 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
952	attrib.exe
4828	attrib.exe
2996	attrib.exe
2732	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-22_771cea1309c7bff5b872373b13603cc4_akira_amadey_cobalt-strike_coinminer_darkgate_glassworm_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_771cea1309c7bff5b872373b13603cc4_akira_amadey_cobalt-strike_coinminer_darkgate_glassworm_.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:5964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-22_771cea1309c7bff5b872373b13603cc4_akira_amadey_cobalt-strike_coinminer_darkgate_glassworm_.exe"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1448
- - C:\Windows\system32\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-22_771cea1309c7bff5b872373b13603cc4_akira_amadey_cobalt-strike_coinminer_darkgate_glassworm_.exe
    3⤵
    - Views/modifies file attributes
    PID:4828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s control.exe"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:3352
- - C:\Windows\system32\attrib.exe
    attrib +h +s control.exe
    3⤵
    - Views/modifies file attributes
    PID:2996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s lib"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4088
- - C:\Windows\system32\attrib.exe
    attrib +h +s lib
    3⤵
    - Views/modifies file attributes
    PID:2732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\2026-07-22_771cea1309c7bff5b872373b13603cc4_akira_amadey_cobalt-strike_coinminer_darkgate_glassworm_.exe""
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2472
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Temp\2026-07-22_771cea1309c7bff5b872373b13603cc4_akira_amadey_cobalt-strike_coinminer_darkgate_glassworm_.exe"
    3⤵
    - Views/modifies file attributes
    PID:952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

2

T1564

Hidden Files and Directories

2

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

node-screenshots.win32-x64-msvc-YC5ZJTNO.node

Path C:\Users\Admin\AppData\Local\Temp\pkg\355ae3918cdccccc4d38a13328b632fd9b3078240cea7ff7ea9e70e12a29e095\node-screenshots.win32-x64-msvc-YC5ZJTNO.node
Size 634KB
SHA256 355ae3918cdccccc4d38a13328b632fd9b3078240cea7ff7ea9e70e12a29e095
MD5 31b92dde2b150928edc471ae737f3788
SHA1 621b5c0b71149306f45443b84231ff189e3814ed
SHA512 cda2ae16f92a5d997fa79787720cc5147ecb23b9d85f61f36ff57617c9ddf6809b29bdc73ac5f62f85fbc5d29cb6387539475947482252fcd3900b169342e078
SSDEEP 12288:5Z052zfIwTbC9H+z2FGzE/YBNz9pP0os2t4XMU5X:Y54fIwk42FjYBFHg2
TLSH
T153D43916BA9A58BDD05AC4B083474B736B3170CA0B25BAFF12D481357F6ABE02B3D754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dpapi.node

Path C:\Users\Admin\AppData\Local\Temp\pkg\c4d5106aca58725d959294e5c07b314353e6f9496b50d61744cc9571ffc9f441\@primno\dpapi\build\Release\dpapi.node
Size 121KB
SHA256 c4d5106aca58725d959294e5c07b314353e6f9496b50d61744cc9571ffc9f441
MD5 73d24bfc49d3bac840cda5343fec6977
SHA1 4f33b8098e7b8e1f8287ecce57bef9016bb928ed
SHA512 9663f3fa2d39fa7b62bc86d1bcecfb0d4e5cdcd81edd362ebb2e9f8ba805e17957545bce75687423836af084149012d6dd48689178317ad0d31b6323ed25b4fe
SSDEEP 3072:1j9mGXIRp4upRdK99WK29gZBbEMNeOxP:1JJ43PY99WK2yZF
TLSH
T1EAC36C5BB2A504BBE1778178C8531A45E7B2B8250B649FDF03A0425E1F337D1AD3AF62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

koffi.node

Path C:\Users\Admin\AppData\Local\Temp\pkg\c56266742f01bb5e4a35cc159abfba3383964824e6c8face9dcb7d2f0d21006b\koffi\build\koffi\win32_x64\koffi.node
Size 2.3MB
SHA256 c56266742f01bb5e4a35cc159abfba3383964824e6c8face9dcb7d2f0d21006b
MD5 4b9ef9f01142f8b1e8f2c0dad39d6aac
SHA1 1f84d3689ffdaaf4b266981b2b45f63ae6c31d77
SHA512 a02191df9e9fc4ef3e18326b8a7fbe9f349a5012db313875ae9af1980525caca99d42456ddc8bfb9311133c17c26816323d605f608f217f6a8c316a3bb4c83cf
SSDEEP 24576:5owViD0+R6GQ/s1k5l0IUNSlPBob4TIFE6zLxIbuzekuyU3K4x+KP2JQVpJtPdgY:5TV+zeTyUa4TP2JQVpJsJ8v
TLSH
T1D2B5DE064758C8E9D83EB022B4177776E56A221B083D52DF04F58D61082ABFD5EAFFC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads