1a56067d238a929db283ba356c90d73caeb35dbd03297d8c8391a2a18bc2c990

General

Target
2026-08-06_a5235fe623e2d66523ffc9824d573f43_akira_cobalt-strike_coinminer_dosia_glassworm_luca-steal.exe
Size 14.8MB
Sample260806-bpswlszhpg
SHA256 1a56067d238a929db283ba356c90d73caeb35dbd03297d8c8391a2a18bc2c990
MD5 a5235fe623e2d66523ffc9824d573f43
SHA1 2186183e1703a16b2725be7045ac3d3d89d70b0c
SHA512 0aea82c8ceffc0d687d1015789d2b6c1bd4552343b051cac2a94253028dfbd3bc31b341e2ff69706e40a130bf1e53bfc4ed7edcdb8f8c909e14080982678cfa6
SSDEEP 98304:/9KfeA3sTl3guCzEic6VfHptwPfj2YiArSFg9UFr9+jvfvFviv2ELQBrvJPpyX5c:1JAc6DJMrEHrcBdoJh
TLSH
T189F65A47F95541E8C1AAD170C6259223BA703C894F3063EB6B50F7B83F36BE45A7A358
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral1/files/0x000f000000024384-2.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Executes dropped EXE 1 IoCs

pid	Process
2324	lsp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4600	taskkill.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2324	lsp.exe
2324	lsp.exe
2324	lsp.exe
2324	lsp.exe
2324	lsp.exe
2324	lsp.exe
2324	lsp.exe
2324	lsp.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4600	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4860	2026-08-06_a5235fe623e2d66523ffc9824d573f43_akira_cobalt-strike_coinminer_dosia_glassworm_luca-steal.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 4600	4860	2026-08-06_a5235fe623e2d66523ffc9824d573f43_akira_cobalt-strike_coinminer_dosia_glassworm_luca-steal.exe	87
PID 4860 wrote to memory of 2324	4860	2026-08-06_a5235fe623e2d66523ffc9824d573f43_akira_cobalt-strike_coinminer_dosia_glassworm_luca-steal.exe	89
PID 2324 wrote to memory of 5016	2324	lsp.exe	92
PID 2324 wrote to memory of 5016	2324	lsp.exe	92
PID 5016 wrote to memory of 1140	5016	chrome.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-08-06_a5235fe623e2d66523ffc9824d573f43_akira_cobalt-strike_coinminer_dosia_glassworm_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_a5235fe623e2d66523ffc9824d573f43_akira_cobalt-strike_coinminer_dosia_glassworm_luca-steal.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM msedge.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4600
- C:\Users\Admin\AppData\Local\FixYourExecOnline\lsp.exe
  "C:\Users\Admin\AppData\Local\FixYourExecOnline\lsp.exe" --zip
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-2695554141"
    3⤵
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:5016
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-2695554141 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-2695554141\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-2695554141 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff86dafc728,0x7ff86dafc734,0x7ff86dafc740
      4⤵
      PID:1140

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4372

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsp.exe

Path C:\Users\Admin\AppData\Local\FixYourExecOnline\lsp.exe
Size 10.7MB
SHA256 127cd97708944110d0f13bbc7b1e912cc6cf12740b16e1c15fd5562e687a83f1
MD5 846e3ab241ff5b3ed2c1ba25388293a7
SHA1 ccf20ab844b9cada75c493c1c18dc1c128a01704
SHA512 5106efb8d8df250fd43e211a30ee4631c6fba4b835fd87d9bf57b199b568427189ef0b6dda78331824a5554d6eee577d2206ece6b1bf8c36b1743151fc110695
SSDEEP 98304:EguCzEic6VfHptwPfj2YiArSFg9UFr9+jvfvFviv2ELQBrvJPpyX5dj:E6DJMrEHrcBdoJh
TLSH
T197B61887F86501E4C5AED175CA259213BA703C894F3063D76B50F7B42F32BE8AA7A354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\hbd-3029408796\localstorage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT.bak

Path C:\Users\Admin\AppData\Local\Temp\hbd-3435489944\localstorage\CURRENT.bak
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

cookie-shm

Path C:\Users\Admin\AppData\Local\Temp\hbd-654231412\cookie-shm
Size 32KB
SHA256 fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb
MD5 b7c14ec6110fa820ca6b65f5aec85911
SHA1 608eeb7488042453c9ca40f7e1398fc1a270f3f4
SHA512 d8d75760f29b1e27ac9430bc4f4ffcec39f1590be5aef2bfb5a535850302e067c288ef59cf3b2c5751009a22a6957733f9f80fa18f2b0d33d90c068a3f08f3b0
SSDEEP 3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-2695554141\Crashpad\settings.dat
Size 40B
SHA256 cdd8f6917a5b196908fb86b5c6ef7ff208659a568f31318192d9989125f19dbd
MD5 079e44f756cbf7c3611979e65772579c
SHA1 e1c599c08557e577b0f690a53547c2961025fa67
SHA512 fc24b9c5fe5576a14fc5e409cefa3159cf7812f3891611bae1d176d2915c466de3e649fd3f704c82110fd3ae4d99e640cf885c2d4bff4f7246dd91a4fd11248c
MD5 SHA1 SHA512

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-2695554141\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads