Overview

overview

10

Static

static

10

2026-07-30...ar.exe

windows10-2004-x64

9

2026-07-30...ar.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    114s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/07/2026, 23:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-30_bfa818c14e72861c49a7ef6e9c39d99a_akira_cobalt-strike_coinminer_glassworm_hijackloader_pos_vidar.exe
  • Size 43.0MB
  • Sample260730-3esxeahb96
  • SHA256 bc0914ccede6a741e79b023c7ccddaf2b2ba02ede16dac294be15786a93665a5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
execution

Malware Config

Signatures

  • Detects executables Discord URL observed in first stage droppers 4 IoCs
  • Detects executables containing URLs to raw contents of a Github gist 4 IoCs
  • Loads dropped DLL 28 IoCs
  • Executes a command shell one-liner 1 TTPs 3 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_bfa818c14e72861c49a7ef6e9c39d99a_akira_cobalt-strike_coinminer_glassworm_hijackloader_pos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-30_bfa818c14e72861c49a7ef6e9c39d99a_akira_cobalt-strike_coinminer_glassworm_hijackloader_pos_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3612
    • C:\Users\Admin\AppData\Local\Temp\2026-07-30_bfa818c14e72861c49a7ef6e9c39d99a_akira_cobalt-strike_coinminer_glassworm_hijackloader_pos_vidar.exe
      C:\Users\Admin\AppData\Local\Temp\2026-07-30_bfa818c14e72861c49a7ef6e9c39d99a_akira_cobalt-strike_coinminer_glassworm_hijackloader_pos_vidar.exe
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1708
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
        • Executes a command shell one-liner
        PID:944
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c
        3⤵
        • Executes a command shell one-liner
        PID:3080
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c cls
        3⤵
        • Executes a command shell one-liner
        PID:3484

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        81d243bd2c585b0f4821__mypyc.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\81d243bd2c585b0f4821__mypyc.pyd
        • Size 211KB
        • SHA256 5b80e8963c54771f2d923eb0469a7a293cabf172bdcff8ef2f28804948c4ec8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _asyncio.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_asyncio.pyd
        • Size 62KB
        • SHA256 97ed94f8d35445573177ba75e17dcf4c667e3c236c0b4d436fa97f8c862cc0bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ctypes.pyd
        • Size 120KB
        • SHA256 7adcea3a5568752a6050610cfbe791a4f8186aaaa002f916b88560a1ddab580f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_socket.pyd
        • Size 75KB
        • SHA256 71f014c3c56661ec93500db1d9f120e11725a8aedabc3a395658275710065178
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ssl.pyd
        • Size 155KB
        • SHA256 4e496cb3b89550cf5883d0b52f5f4660524969c7a5fa35a3b233df4f482d0482
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _http_parser.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\aiohttp\_http_parser.pyd
        • Size 250KB
        • SHA256 8732ea16a5d376a3e00f6b4ee3cc6fda7846c8c95753e1641c82f9c2f78b3d0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _http_writer.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\aiohttp\_http_writer.pyd
        • Size 43KB
        • SHA256 7fb13aff184ae5d28cb3fa369314a69ab3aad96f8c20fe5dd5032be02e5033dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        reader_c.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\aiohttp\_websocket\reader_c.pyd
        • Size 134KB
        • SHA256 21d361f3a41da90c373c607f64e913c4198d31e374d6f9c195925445035e50b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libcrypto-1_1.dll
        • Size 3.3MB
        • SHA256 976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-7.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libffi-7.dll
        • Size 32KB
        • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libssl-1_1.dll
        • Size 686KB
        • SHA256 2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _multidict.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\multidict\_multidict.pyd
        • Size 77KB
        • SHA256 722e3bc918b47b78e0e560864bd870b51af33f7dfdf77b54f2a99b3c5009ed94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\select.pyd
        • Size 28KB
        • SHA256 8b4b5d37b829ba885281134d9948f249e0ecd553ae72deda6a404619fdf4ccc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _quoting_c.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\yarl\_quoting_c.pyd
        • Size 79KB
        • SHA256 b4d133dc11495ebb359adee9abb18c26466dd657673d96faeeaf587e82d53089
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3612_134299276483926468\VCRUNTIME140.dll
        • Size 96KB
        • SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3612_134299276483926468\_bz2.pyd
        • Size 81KB
        • SHA256 190ade9f09be287fcc5328a6a497921f164c5c67e6d4fcdcb8b8fd6853b06fe2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3612_134299276483926468\_hashlib.pyd
        • Size 60KB
        • SHA256 23063b56aa067c3d4a79a873d4db113f6396f3e1fe0af4b12d95d240c4cf9969
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3612_134299276483926468\_lzma.pyd
        • Size 154KB
        • SHA256 5361824ddac7c84811b80834eca3acb5fe6d63bf506cf92baf5bd6c3786bf209
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _overlapped.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3612_134299276483926468\_overlapped.pyd
        • Size 47KB
        • SHA256 370b4ad06881c3cb781be0f78476eaeb5e440c60498f5791c3d413860fdc9b5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3612_134299276483926468\_queue.pyd
        • Size 29KB
        • SHA256 24c23d04d274a4c1234f1a1a35b1805e1f17f99968f8baeec0c3b5295f05608a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _uuid.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3612_134299276483926468\_uuid.pyd
        • Size 23KB
        • SHA256 e650244ff050dffadd9eb2b4462ec1f28bc2c9d6e090e05b2e8b0d9451712ff3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mask.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3612_134299276483926468\aiohttp\_websocket\mask.pyd
        • Size 33KB
        • SHA256 94e030c1ff78fb757b48af86ea00c3808a9ec0c0fc0622e952292fbd5ebf1130
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cd.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3612_134299276483926468\charset_normalizer\cd.pyd
        • Size 10KB
        • SHA256 54ed1a662d7b02ac19d8227badf17a2d6924395474c1cce5a2314eacf4f544a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        code.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3612_134299276483926468\code.dll
        • Size 23.6MB
        • SHA256 e5cb5768354aad6286a2009567da6791cb4e7384f5b2d5d849de9f9b22190f73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _frozenlist.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3612_134299276483926468\frozenlist\_frozenlist.pyd
        • Size 66KB
        • SHA256 3df48e9b4341e6e4960b353d24c7ad8a010db1993879ac27fd68ce2e9486064d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _helpers_c.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3612_134299276483926468\propcache\_helpers_c.pyd
        • Size 62KB
        • SHA256 de55a9155cddc872707e822fb1c60b7a1f718bd20a068f0c79e205a7b26af917
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python310.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3612_134299276483926468\python310.dll
        • Size 4.3MB
        • SHA256 c30589187be320bc8e65177aeb8dc1d39957f7b7dcda4c13524dd7f436fb0948
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3612_134299276483926468\unicodedata.pyd
        • Size 1.1MB
        • SHA256 a3aa957cf891a411a4e22e41aa4053265eccba4d47b5abe6475789ebba7fcca0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1708-95-0x00007FFCA9DB0000-0x00007FFCAB5C7000-memory.dmp
        Download

        memory/1708-94-0x00007FF7C4980000-0x00007FF7C74BB000-memory.dmp
        Download

        memory/3612-93-0x00007FF7C4980000-0x00007FF7C74BB000-memory.dmp
        Download