Analysis
- max time kernel
150s - max time network
81s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/07/2026, 23:00
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-24_49904443f8dc4b1b44404a2a732b16fe_akira_blankgrabber_cobalt-strike_coinminer_glassworm_ice.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-24_49904443f8dc4b1b44404a2a732b16fe_akira_blankgrabber_cobalt-strike_coinminer_glassworm_ice.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-24_49904443f8dc4b1b44404a2a732b16fe_akira_blankgrabber_cobalt-strike_coinminer_glassworm_ice.exe
- Size 30.9MB
- Sample260724-2y56eavthx
- SHA256 349997d0ff01f8a9a33618dedc0c99df892c8efa6773b075bd3ace7c73869f4a
- MD5 49904443f8dc4b1b44404a2a732b16fe
- SHA1 7cfe44bf2fbb8a4206dd030eea101fc755f81dd1
- SHA512 34790b3736616d061522473437253e329f931c7d9655936daf8ca426d7f9be468e495b6279fcc7a2ef4f8fc3da89b034e894a6ecea6c6cef716734a877da8ac5
- SSDEEP 196608:Q9Ml6vYQ8VvPeb1UBDglPC0Y/OnFt7yO7uq5EvYq07kUM:QB8VvPeb1ADOC0Y/OnFt7yOBEE7kUM
- TLSH T11B6796215B4D8745D126BD3CD0874A01D3F5BF88C32E8F1F9BE08CE9669B6427A1EA4D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 2026-07-24_49904443f8dc4b1b44404a2a732b16fe_akira_blankgrabber_cobalt-strike_coinminer_glassworm_ice.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5132 2026-07-24_49904443f8dc4b1b44404a2a732b16fe_akira_blankgrabber_cobalt-strike_coinminer_glassworm_ice.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5132 2026-07-24_49904443f8dc4b1b44404a2a732b16fe_akira_blankgrabber_cobalt-strike_coinminer_glassworm_ice.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-24_49904443f8dc4b1b44404a2a732b16fe_akira_blankgrabber_cobalt-strike_coinminer_glassworm_ice.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-24_49904443f8dc4b1b44404a2a732b16fe_akira_blankgrabber_cobalt-strike_coinminer_glassworm_ice.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5132
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4484
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\loader.log
- Size 120B
- SHA256 e874a72df7c7f3b894b21ae7d46624b5769849e8023bff3b1dc8cd2e30fd15e3
- MD5 4c9bfe181d55f726f9d6bcc7cc395fad
- SHA1 649e1ab5295176636c999c28da2494de994d88b8
- SHA512 2c561734794a4c5b48e43ebd0120fcfd4a941954932421b830e35d1cdc607420dc1634ca077f4b48890664a4234d64c4c46c185155b32e7e2fed93b9cf086574
- TLSH T1C0B012A8F55562F872733220D080F3B43B305409A0A1383CA3CE361A60A5BAF7367083
- MD5 SHA1 SHA512 TLSH