Overview

overview

10

Static

static

10

2026-08-16...ij.exe

windows10-2004-x64

9

2026-08-16...ij.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    16/08/2026, 03:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-16_b2a4b00008fd3993d3c92ca6cd02bd89_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
  • Size 29.3MB
  • Sample260816-efbshsba93
  • SHA256 11a84674afd1118c3e0d644daa1b5fe20459a172ae847f337dc225acb877b75c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10

Malware Config

Signatures

  • Detects executables referencing virtualization MAC addresses 1 IoCs
  • Loads dropped DLL 12 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-16_b2a4b00008fd3993d3c92ca6cd02bd89_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-16_b2a4b00008fd3993d3c92ca6cd02bd89_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4744
    • C:\Users\Admin\AppData\Local\Temp\2026-08-16_b2a4b00008fd3993d3c92ca6cd02bd89_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
      C:\Users\Admin\AppData\Local\Temp\2026-08-16_b2a4b00008fd3993d3c92ca6cd02bd89_akira_blankgrabber_cobalt-strike_coinminer_glassworm_hij.exe
      2⤵
      • Loads dropped DLL
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:3752

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4744_429369_8W43eTLeWtg\VCRUNTIME140.dll
        • Size 116KB
        • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4744_429369_8W43eTLeWtg\_bz2.pyd
        • Size 83KB
        • SHA256 324268786921ec940cbd4b5e2f71dafd08e578a12e373a715658527e5b211697
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _cffi_backend.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4744_429369_8W43eTLeWtg\_cffi_backend.pyd
        • Size 177KB
        • SHA256 058cb0de6db01e45d7f8e1f5947adfa32b5ffbb03836e13578321759f69dbc95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4744_429369_8W43eTLeWtg\_ctypes.pyd
        • Size 122KB
        • SHA256 8978972cf341ccd0edf8435d63909a739df7ef29ec7dd57ed5cab64b342891f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4744_429369_8W43eTLeWtg\_lzma.pyd
        • Size 156KB
        • SHA256 6d548db0ab73291f82cf0f4ca9ec0c81460185319c8965e829faeacae19444ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _uuid.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4744_429369_8W43eTLeWtg\_uuid.pyd
        • Size 25KB
        • SHA256 793e44c75e7d746af2bb5176e46c454225f07cb27b1747f1b83d1748d81ad9ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _rust.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4744_429369_8W43eTLeWtg\cryptography\hazmat\bindings\_rust.pyd
        • Size 9.4MB
        • SHA256 051e355666d8d242827c7969b70f6da6b7f27aa23fcd5c36fcb0c81bc25a6856
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4744_429369_8W43eTLeWtg\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        payload_protected_7328919e.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4744_429369_8W43eTLeWtg\payload_protected_7328919e.dll
        • Size 5.7MB
        • SHA256 c2003c58e9c4997035a4be63988e09849e85837d187dc6367ff175b54355dd40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4744_429369_8W43eTLeWtg\python3.dll
        • Size 66KB
        • SHA256 29f173e0147390a99f541ba0c0231fdd7dfbca84d0e2e561ef352bf1ec72f5db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python312.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4744_429369_8W43eTLeWtg\python312.dll
        • Size 6.6MB
        • SHA256 8ad53c67c2b4db4387d5f72ee2a3ca80c40af444b22bf41a6cfda2225a27bb93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download