Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/08/2026, 01:19
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-06_a5235fe623e2d66523ffc9824d573f43_akira_cobalt-strike_coinminer_dosia_glassworm_luca-steal.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-06_a5235fe623e2d66523ffc9824d573f43_akira_cobalt-strike_coinminer_dosia_glassworm_luca-steal.exe
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
General
- Target 2026-08-06_a5235fe623e2d66523ffc9824d573f43_akira_cobalt-strike_coinminer_dosia_glassworm_luca-steal.exe
- Size 14.8MB
- Sample260806-bpswlszhpg
- SHA256 1a56067d238a929db283ba356c90d73caeb35dbd03297d8c8391a2a18bc2c990
- MD5 a5235fe623e2d66523ffc9824d573f43
- SHA1 2186183e1703a16b2725be7045ac3d3d89d70b0c
- SHA512 0aea82c8ceffc0d687d1015789d2b6c1bd4552343b051cac2a94253028dfbd3bc31b341e2ff69706e40a130bf1e53bfc4ed7edcdb8f8c909e14080982678cfa6
- SSDEEP 98304:/9KfeA3sTl3guCzEic6VfHptwPfj2YiArSFg9UFr9+jvfvFviv2ELQBrvJPpyX5c:1JAc6DJMrEHrcBdoJh
- TLSH T189F65A47F95541E8C1AAD170C6259223BA703C894F3063EB6B50F7B83F36BE45A7A358
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Kills process with taskkill 1 IoCs
pid Process 5324 taskkill.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5324 taskkill.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3068 2026-08-06_a5235fe623e2d66523ffc9824d573f43_akira_cobalt-strike_coinminer_dosia_glassworm_luca-steal.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3068 wrote to memory of 5324 3068 2026-08-06_a5235fe623e2d66523ffc9824d573f43_akira_cobalt-strike_coinminer_dosia_glassworm_luca-steal.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_a5235fe623e2d66523ffc9824d573f43_akira_cobalt-strike_coinminer_dosia_glassworm_luca-steal.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-06_a5235fe623e2d66523ffc9824d573f43_akira_cobalt-strike_coinminer_dosia_glassworm_luca-steal.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\system32\taskkill.exe"taskkill" /IM msedge.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5324
-