6aa550b813d933640454f36f78405856996e31d0dfa6bc75b5d1a109c89eb0ac

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 02:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_208adbe2795c9c17e3e4c7d8ea5bb095_akira_cobalt-strike.exe
Size 2.2MB
Sample260803-deb68axcld
SHA256 6aa550b813d933640454f36f78405856996e31d0dfa6bc75b5d1a109c89eb0ac
MD5 208adbe2795c9c17e3e4c7d8ea5bb095
SHA1 1ca592a2119804c4ba8e4536a7d660ede3104a47
SHA512 6b5a27b988166b4303aea7ebbe49c3ffcfbe37c9894b6d1854ffb00b7dd906a525e8eea83e2fd3ba230cd45f1d612b9b020bf17566b2dc11cd90fb134d45aaa0
SSDEEP 49152:G6wBTpA5hCR6RR++yd+Ne7RoeSuNFul+UsppQ8UvmSHZI4JdkFYvaRVqCvQdnwDg:XwBqK8RR++yd+Ne7RoeSuNFul+UsppQz
TLSH
T12DB5AE526655C951EC1F8030C1D9BB3E6124F28BA226AFBB3C847D79CCE2ECB4B55781
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32	2026-08-03_208adbe2795c9c17e3e4c7d8ea5bb095_akira_cobalt-strike.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID	2026-08-03_208adbe2795c9c17e3e4c7d8ea5bb095_akira_cobalt-strike.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}	2026-08-03_208adbe2795c9c17e3e4c7d8ea5bb095_akira_cobalt-strike.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\EdgeUpdate\\hoshimi_miyabi.dll"	2026-08-03_208adbe2795c9c17e3e4c7d8ea5bb095_akira_cobalt-strike.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32\ThreadingModel = "Apartment"	2026-08-03_208adbe2795c9c17e3e4c7d8ea5bb095_akira_cobalt-strike.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-03_208adbe2795c9c17e3e4c7d8ea5bb095_akira_cobalt-strike.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_208adbe2795c9c17e3e4c7d8ea5bb095_akira_cobalt-strike.exe"
1⤵
- Modifies registry class
PID:2848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2848-1-0x00007FF743C60000-0x00007FF743E4F000-memory.dmp

Download