2989d6e7fb8455632f64973dbac35dcfd76b4c0185da88146f07f5fd26f690ef

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 03:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_17cbf4bef8cd09b9a18ef7032baf20cd_akira_cobalt-strike_glassworm_satacom_vidar.exe
Size 3.3MB
Sample260811-ecfbjafm6x
SHA256 2989d6e7fb8455632f64973dbac35dcfd76b4c0185da88146f07f5fd26f690ef
MD5 17cbf4bef8cd09b9a18ef7032baf20cd
SHA1 7fe8afb18006dd3d17d4dac1fa9f24b20bb3736a
SHA512 ae641278c0011bd02653e1ac08bca31ba6f23fa49e9d4963772f0295b4a28fd4fcaa46131e51d7b76f6611bde06059a25a3b4fbd88b42d8fb6a5bc374eb1352e
SSDEEP 49152:QCX5pBxaz0h6Z7e18yBz/xYqM20/E9L9IE513iiBtj20kqOcN:QcthYMiqj20D
TLSH
T130F539217B5A99ADC15AC074824B4B726A3170CF0F35BAEF45D486383E69AF52F3C358
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

credential_access defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6068	cmd.exe
1292	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2492	timeout.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1964	2026-08-11_17cbf4bef8cd09b9a18ef7032baf20cd_akira_cobalt-strike_glassworm_satacom_vidar.exe
1964	2026-08-11_17cbf4bef8cd09b9a18ef7032baf20cd_akira_cobalt-strike_glassworm_satacom_vidar.exe
1964	2026-08-11_17cbf4bef8cd09b9a18ef7032baf20cd_akira_cobalt-strike_glassworm_satacom_vidar.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 6068	1964	2026-08-11_17cbf4bef8cd09b9a18ef7032baf20cd_akira_cobalt-strike_glassworm_satacom_vidar.exe	90
PID 6068 wrote to memory of 1292	6068	cmd.exe	92
PID 1292 wrote to memory of 2492	1292	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-08-11_17cbf4bef8cd09b9a18ef7032baf20cd_akira_cobalt-strike_glassworm_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_17cbf4bef8cd09b9a18ef7032baf20cd_akira_cobalt-strike_glassworm_satacom_vidar.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\system32\cmd.exe
  "cmd" /c start /min /b del.bat
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K del.bat
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1292
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

del.bat

Path C:\Users\Admin\AppData\Local\Temp\del.bat
Size 146B
SHA256 9024caa3d88d06846967a6d0c3bb4c7a0c950f0c2b9cbe80047d749a30638d11
MD5 f060762bbc4cb3441d391d3ccd025609
SHA1 d9179b926df618d8dea52342fcb16b523730f758
SHA512 1dcfcd8ae925d60e7ba23503e7a3483b563ff2b1d3d252064d17f76d78dbec819feb7b3b8c149afaadc7a3e2a1d6956513b985dca215c14277bbf127ff268e17
TLSH
T1D6C08C81942B9602086278D4867A58C500897087866175502188C71B889F05B19216DA
MD5 SHA1 SHA512 TLSH

Submit Download