6b9fdcc0010eee1bdcb0270309946914db6b6a241322e6775802a3fd1daf7463

General

Target
2026-07-22_11ab82d96de766adcd3f67df641e2a68_akira_amadey_cobalt-strike_coinminer_darkgate_glassworm_.exe
Size 268.8MB
Sample260723-aprg4sed25
SHA256 6b9fdcc0010eee1bdcb0270309946914db6b6a241322e6775802a3fd1daf7463
MD5 11ab82d96de766adcd3f67df641e2a68
SHA1 5e969579528271b228ded4d608565861b73d272f
SHA512 9f12d530467b800510c1ceaf78c155597663c6e3cf4a279ea9e465d7c34fa9e631e144c2f45c404b7c65d14d6c3eff2d4e63723374e19c4b9251fa378f863baf
SSDEEP 1572864:dMoCm/sXwggZv2JvUyNumKE2kszApi4ytP63QDysUyNuGg9m9o:q4sXw3expi4ytP63QOw6
TLSH
T18AD80A96910D0879E3FFE67074664B67E662791333ECAC52FE08670407EA3723A78746
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
4868	2026-07-22_11ab82d96de766adcd3f67df641e2a68_akira_amadey_cobalt-strike_coinminer_darkgate_glassworm_.exe
4868	2026-07-22_11ab82d96de766adcd3f67df641e2a68_akira_amadey_cobalt-strike_coinminer_darkgate_glassworm_.exe
4868	2026-07-22_11ab82d96de766adcd3f67df641e2a68_akira_amadey_cobalt-strike_coinminer_darkgate_glassworm_.exe
4868	2026-07-22_11ab82d96de766adcd3f67df641e2a68_akira_amadey_cobalt-strike_coinminer_darkgate_glassworm_.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 4 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3744	cmd.exe
2016	cmd.exe
3140	cmd.exe
5656	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 2016	4868	2026-07-22_11ab82d96de766adcd3f67df641e2a68_akira_amadey_cobalt-strike_coinminer_darkgate_glassworm_.exe	89
PID 2016 wrote to memory of 5864	2016	cmd.exe	90
PID 4868 wrote to memory of 3140	4868	2026-07-22_11ab82d96de766adcd3f67df641e2a68_akira_amadey_cobalt-strike_coinminer_darkgate_glassworm_.exe	91
PID 3140 wrote to memory of 5168	3140	cmd.exe	92
PID 4868 wrote to memory of 5656	4868	2026-07-22_11ab82d96de766adcd3f67df641e2a68_akira_amadey_cobalt-strike_coinminer_darkgate_glassworm_.exe	93
PID 5656 wrote to memory of 2484	5656	cmd.exe	94
PID 4868 wrote to memory of 3744	4868	2026-07-22_11ab82d96de766adcd3f67df641e2a68_akira_amadey_cobalt-strike_coinminer_darkgate_glassworm_.exe	95
PID 3744 wrote to memory of 2116	3744	cmd.exe	96

Views/modifies file attributes 1 TTPs 4 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5864	attrib.exe
5168	attrib.exe
2484	attrib.exe
2116	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-22_11ab82d96de766adcd3f67df641e2a68_akira_amadey_cobalt-strike_coinminer_darkgate_glassworm_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_11ab82d96de766adcd3f67df641e2a68_akira_amadey_cobalt-strike_coinminer_darkgate_glassworm_.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-22_11ab82d96de766adcd3f67df641e2a68_akira_amadey_cobalt-strike_coinminer_darkgate_glassworm_.exe"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2016
- - C:\Windows\system32\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-22_11ab82d96de766adcd3f67df641e2a68_akira_amadey_cobalt-strike_coinminer_darkgate_glassworm_.exe
    3⤵
    - Views/modifies file attributes
    PID:5864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s control.exe"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:3140
- - C:\Windows\system32\attrib.exe
    attrib +h +s control.exe
    3⤵
    - Views/modifies file attributes
    PID:5168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s lib"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:5656
- - C:\Windows\system32\attrib.exe
    attrib +h +s lib
    3⤵
    - Views/modifies file attributes
    PID:2484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\2026-07-22_11ab82d96de766adcd3f67df641e2a68_akira_amadey_cobalt-strike_coinminer_darkgate_glassworm_.exe""
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:3744
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Temp\2026-07-22_11ab82d96de766adcd3f67df641e2a68_akira_amadey_cobalt-strike_coinminer_darkgate_glassworm_.exe"
    3⤵
    - Views/modifies file attributes
    PID:2116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

2

T1564

Hidden Files and Directories

2

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

node-screenshots.win32-x64-msvc-YC5ZJTNO.node

Path C:\Users\Admin\AppData\Local\Temp\pkg\355ae3918cdccccc4d38a13328b632fd9b3078240cea7ff7ea9e70e12a29e095\node-screenshots.win32-x64-msvc-YC5ZJTNO.node
Size 634KB
SHA256 355ae3918cdccccc4d38a13328b632fd9b3078240cea7ff7ea9e70e12a29e095
MD5 31b92dde2b150928edc471ae737f3788
SHA1 621b5c0b71149306f45443b84231ff189e3814ed
SHA512 cda2ae16f92a5d997fa79787720cc5147ecb23b9d85f61f36ff57617c9ddf6809b29bdc73ac5f62f85fbc5d29cb6387539475947482252fcd3900b169342e078
SSDEEP 12288:5Z052zfIwTbC9H+z2FGzE/YBNz9pP0os2t4XMU5X:Y54fIwk42FjYBFHg2
TLSH
T153D43916BA9A58BDD05AC4B083474B736B3170CA0B25BAFF12D481357F6ABE02B3D754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dpapi.node

Path C:\Users\Admin\AppData\Local\Temp\pkg\c4d5106aca58725d959294e5c07b314353e6f9496b50d61744cc9571ffc9f441\@primno\dpapi\build\Release\dpapi.node
Size 121KB
SHA256 c4d5106aca58725d959294e5c07b314353e6f9496b50d61744cc9571ffc9f441
MD5 73d24bfc49d3bac840cda5343fec6977
SHA1 4f33b8098e7b8e1f8287ecce57bef9016bb928ed
SHA512 9663f3fa2d39fa7b62bc86d1bcecfb0d4e5cdcd81edd362ebb2e9f8ba805e17957545bce75687423836af084149012d6dd48689178317ad0d31b6323ed25b4fe
SSDEEP 3072:1j9mGXIRp4upRdK99WK29gZBbEMNeOxP:1JJ43PY99WK2yZF
TLSH
T1EAC36C5BB2A504BBE1778178C8531A45E7B2B8250B649FDF03A0425E1F337D1AD3AF62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

koffi.node

Path C:\Users\Admin\AppData\Local\Temp\pkg\c56266742f01bb5e4a35cc159abfba3383964824e6c8face9dcb7d2f0d21006b\koffi\build\koffi\win32_x64\koffi.node
Size 2.3MB
SHA256 c56266742f01bb5e4a35cc159abfba3383964824e6c8face9dcb7d2f0d21006b
MD5 4b9ef9f01142f8b1e8f2c0dad39d6aac
SHA1 1f84d3689ffdaaf4b266981b2b45f63ae6c31d77
SHA512 a02191df9e9fc4ef3e18326b8a7fbe9f349a5012db313875ae9af1980525caca99d42456ddc8bfb9311133c17c26816323d605f608f217f6a8c316a3bb4c83cf
SSDEEP 24576:5owViD0+R6GQ/s1k5l0IUNSlPBob4TIFE6zLxIbuzekuyU3K4x+KP2JQVpJtPdgY:5TV+zeTyUa4TP2JQVpJsJ8v
TLSH
T1D2B5DE064758C8E9D83EB022B4177776E56A221B083D52DF04F58D61082ABFD5EAFFC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads