8905b7149f8876bb1c837e4bcda254e279c59ae8667c76cff8c8c3e0fee74d1f

General

Target
2026-07-27_e97f60218ccd1df4e59c189abd3cbf7b_akira_coinminer_gazer_glassworm_helldown_icedid_jaff_luc.exe
Size 98.7MB
Sample260727-2md8jsserg
SHA256 8905b7149f8876bb1c837e4bcda254e279c59ae8667c76cff8c8c3e0fee74d1f
MD5 e97f60218ccd1df4e59c189abd3cbf7b
SHA1 b695e70a91d4b6ce7e7e37323282e1b911f41af8
SHA512 54eb0b84ee6a833d1bf427732a1d3e521d27436f2ffbdb11249805afdb470e8e0953bfb044ba2e0452fc6667cc325e0e63721c9d078b4143990e8466f1f063d4
SSDEEP 786432:Vqf7hYg8vYVyahXJyMF6d9MdllFrd1mdG7ehUJ5KE:MTb+YVyaPyMNdllFrCW5KE
TLSH
T191387D13B3A705D5E8BBDA7196E751236932BC066F3086DF324C47261F73AE05A7AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3340	stealer_embedded.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2384	powershell.exe
1620	powershell.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1244	cmd.exe
5280	cmd.exe
6044	cmd.exe
4940	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2384	powershell.exe
2384	powershell.exe
2384	powershell.exe
1620	powershell.exe
1620	powershell.exe
1620	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2384	powershell.exe
Token: SeDebugPrivilege	1620	powershell.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 5492 wrote to memory of 3340	5492	2026-07-27_e97f60218ccd1df4e59c189abd3cbf7b_akira_coinminer_gazer_glassworm_helldown_icedid_jaff_luc.exe	89
PID 3340 wrote to memory of 4940	3340	stealer_embedded.exe	90
PID 3340 wrote to memory of 1244	3340	stealer_embedded.exe	91
PID 1244 wrote to memory of 2568	1244	cmd.exe	93
PID 4940 wrote to memory of 2384	4940	cmd.exe	94
PID 2568 wrote to memory of 2744	2568	net.exe	95
PID 3340 wrote to memory of 5280	3340	stealer_embedded.exe	96
PID 5280 wrote to memory of 4868	5280	cmd.exe	97
PID 4868 wrote to memory of 4368	4868	net.exe	98
PID 3340 wrote to memory of 6044	3340	stealer_embedded.exe	99
PID 6044 wrote to memory of 1620	6044	cmd.exe	101
PID 2384 wrote to memory of 3344	2384	powershell.exe	102
PID 3344 wrote to memory of 5144	3344	csc.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-07-27_e97f60218ccd1df4e59c189abd3cbf7b_akira_coinminer_gazer_glassworm_helldown_icedid_jaff_luc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_e97f60218ccd1df4e59c189abd3cbf7b_akira_coinminer_gazer_glassworm_helldown_icedid_jaff_luc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5492
- C:\Users\Admin\AppData\Local\Temp\stealer_embedded.exe
  C:\Users\Admin\AppData\Local\Temp\stealer_embedded.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "$signature = Add-Type -MemberDefinition '[DllImport(\"kernel32.dll\")] public static extern IntPtr GetConsoleWindow();[DllImport(\"user32.dll\")] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);' -Name Win32 -Namespace Native -PassThru; $h = [Native.Win32]::GetConsoleWindow(); [Native.Win32]::ShowWindow($h, 0)""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4940
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "$signature = Add-Type -MemberDefinition '[DllImport(\"kernel32.dll\")] public static extern IntPtr GetConsoleWindow();[DllImport(\"user32.dll\")] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);' -Name Win32 -Namespace Native -PassThru; $h = [Native.Win32]::GetConsoleWindow(); [Native.Win32]::ShowWindow($h, 0)"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2384
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\22bni5na\22bni5na.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3344
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC1C0.tmp" "c:\Users\Admin\AppData\Local\Temp\22bni5na\CSC5542C2EDFF1E4DF6AE76F19E255B56AD.TMP"
        6⤵
        
        PID:5144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session 2>nul"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1244
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2568
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:2744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session 2>nul"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5280
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4868
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:4368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\stealer_embedded.exe' -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -ErrorAction SilentlyContinue Add-MpPreference -ExclusionProcess 'stealer.exe' -ErrorAction SilentlyContinue Add-MpPreference -ExclusionProcess 'msedge_*.exe' -ErrorAction SilentlyContinue } catch {}""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6044
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "try {
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

PowerShell

1

T1059.001

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 19522c7e140736208a28a9056be124d495ec75471725dc9d11fbffd9ba767070
MD5 b14c5f52c7c818e7f55db88ec807c3d9
SHA1 95f9d7165d7637c5e32450477922de8e08e8d57b
SHA512 a2fa55a5b8737c99e2f5df59add5b15c7040d6b3719ba0777f88cbf66e86d74f1d0a315267b7b483ae21d3e869268d2ad58b3a674720ed6996c2f86eefe5099a
TLSH
T1CA116673F3CC8624DC5A403610CEA91137B687CB44DEDE6B7B84D155B82F685DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

22bni5na.dll

Path C:\Users\Admin\AppData\Local\Temp\22bni5na\22bni5na.dll
Size 3KB
SHA256 692613ea5180fb0b08bb4a08268b8da9a7056ad7f41dcbf52f48966a3957543c
MD5 f37cefc5dab3816af73be83a6a49c257
SHA1 110151277bdc0074b72abb9102e72d5a913b5311
SHA512 09b5880322c717af0aa642f9c5c3d08ee9c41e6bc13130a910b99a9be15379f280d1c9fc78c3fb0c90777c0445515f5a781a97571095bb54f57cfbd868167b0b
TLSH
T1FC51FD1AA3E84627E0774730ADF3032633B8FC409F73575E19C00329AC61A645E32BB2
MD5 SHA1 SHA512 TLSH

Submit Download

RESC1C0.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESC1C0.tmp
Size 1KB
SHA256 598e1fd56e4e6de0c8e7c884837b71e52db85ed406c3d8662cc3febe53033674
MD5 1136e94fc67b0457ee9bea943d8e0535
SHA1 ad743e39e32404dfcfe1c28dac6de0bf46668ec5
SHA512 c3ffade0ff07c2f93b11a457afacca7ebd3a6eb25cdac9b6e5c853121565670194d6d59848c4e948458e87bce79f4c1077eaea23dc5cda8cbb699b7daf94d9ae
TLSH
T10F21AF0953E9471FF0774732A9F6175F93B4FD64EFA2635A9580422C1C11504EEA0F72
MD5 SHA1 SHA512 TLSH

Submit Download

22bni5na.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\22bni5na\22bni5na.0.cs
Size 284B
SHA256 c0a93752cbf09a488ee9f929899553e1f86bc93b5feb75bb5c2e05715b57bf8a
MD5 84814ee010922e01f287bca07acbc44b
SHA1 1b6cd77ad4f31889c7e42bbb22eae9d671fd80aa
SHA512 b610bbe72f5a105813b4c61f1a37db649dd59dedf5db9b3ee4a6ddcb0eeae00cc2a2ba426b596d573acc30cdf7bd549cc0f4a184d742bd1be897d5acac5cdb58
TLSH
T136D0C218AAA2FE7000534C164D9BE0FCB6179126227B1A04BAB91320DF4B0094275A1A
MD5 SHA1 SHA512 TLSH

Submit Download

22bni5na.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\22bni5na\22bni5na.cmdline
Size 369B
SHA256 8c6294711d280fd07ef079b395256c71016b050982bb7a0bb82a12e1f4a89909
MD5 2b640a4e7e2ae5fecba3eb370106e8fb
SHA1 b403825720dd12be819b5090558bc6656965b4f1
SHA512 73733e9b2f17d804911f5aea33014773cf3cd999264fcd34529de3f09d55d3977b8561edc0a01b1ffb3da78c441a26b43285a5a603a7fd84a64dcb3c647f4151
TLSH
T1A5E0682B424AC27EC2DD111F21A9E6FCC27A064329813F845290848DE43700067E1743
MD5 SHA1 SHA512 TLSH

Submit Download

CSC5542C2EDFF1E4DF6AE76F19E255B56AD.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\22bni5na\CSC5542C2EDFF1E4DF6AE76F19E255B56AD.TMP
Size 652B
SHA256 baef35cf452021d829cc071b3c1256d9feecece7fdbceccd1ee496a933012fa6
MD5 18b3fd0f4e53ff129bb53cd2bf3fa251
SHA1 38cc7e7763801b8d2524f26e8fcf6ab7b530d221
SHA512 7299e21be46fd1304bb5bc5f008d8842ed3abe7b9af29a414299e60e5132d1c821e3a26d9d9e4c534389005fe40d4c9856c0da5a113a7fa44695e121786baaea
TLSH
T1C0F05E0963F8020EF0F38B71BDF643A391A8BC64DE3293ED5480031D28649109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2384-8-0x000001F3E2700000-0x000001F3E2722000-memory.dmp

Download

memory/2384-30-0x000001F3E2770000-0x000001F3E2778000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads