Analysis
- max time kernel
150s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
24/08/2026, 08:52
General
- Target 2026-08-23_730304bcc05d4d5370cfacd1f4c6f722_akira_cobalt-strike.exe
- Size 1.4MB
- Sample260824-ksvdaavdnd
- SHA256 4e0ee7a892b1751678f84dec89120e9c4f603acd11c4a26b85143f737bfe8734
Malware Config
Signatures
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
- Detects executables manipulated with Fody 2 IoCs
- Loads dropped DLL 2 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_730304bcc05d4d5370cfacd1f4c6f722_akira_cobalt-strike.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-23_730304bcc05d4d5370cfacd1f4c6f722_akira_cobalt-strike.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_730304bcc05d4d5370cfacd1f4c6f722_akira_cobalt-strike.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-23_730304bcc05d4d5370cfacd1f4c6f722_akira_cobalt-strike.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
1Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
cversions.2.0.dll
memory/4244-22-0x00007FF67E510000-0x00007FF67E675000-memory.dmp
memory/4572-48-0x00007FFAC16B0000-0x00007FFAC2054000-memory.dmp
memory/4572-53-0x0000022C63F70000-0x0000022C64132000-memory.dmp
memory/4572-26-0x0000000140000000-0x0000000140125000-memory.dmp
memory/4572-27-0x0000000140000000-0x0000000140125000-memory.dmp
memory/4572-28-0x0000000140000000-0x0000000140125000-memory.dmp
memory/4572-29-0x0000000140000000-0x0000000140125000-memory.dmp
memory/4572-30-0x0000000140000000-0x0000000140125000-memory.dmp
memory/4572-31-0x00007FF67E510000-0x00007FF67E675000-memory.dmp
memory/4572-32-0x00007FFAC183F000-0x00007FFAC1840000-memory.dmp
memory/4572-37-0x0000022C4AFA0000-0x0000022C4AFAE000-memory.dmp
memory/4572-23-0x0000000140000000-0x0000000140125000-memory.dmp
memory/4572-38-0x00007FFAC16B0000-0x00007FFAC2054000-memory.dmp
memory/4572-39-0x0000022C63800000-0x0000022C638E6000-memory.dmp
memory/4572-42-0x00007FFAC16B0000-0x00007FFAC2054000-memory.dmp
memory/4572-43-0x00007FFAC16B0000-0x00007FFAC2054000-memory.dmp
memory/4572-45-0x00007FFAC16B0000-0x00007FFAC2054000-memory.dmp
memory/4572-46-0x00007FFAC16B0000-0x00007FFAC2054000-memory.dmp
memory/4572-47-0x00007FFAC16B0000-0x00007FFAC2054000-memory.dmp
memory/4572-5-0x0000000140000000-0x0000000140125000-memory.dmp
memory/4572-49-0x0000000140000000-0x0000000140125000-memory.dmp
memory/4572-24-0x00007FF67E510000-0x00007FF67E675000-memory.dmp
memory/4572-54-0x0000022C63DA0000-0x0000022C63DF0000-memory.dmp
memory/4572-50-0x0000022C63B70000-0x0000022C63CA0000-memory.dmp
memory/4572-55-0x0000022C64670000-0x0000022C64B98000-memory.dmp
memory/4572-56-0x0000022C64140000-0x0000022C643C0000-memory.dmp
memory/4572-58-0x0000022C4B470000-0x0000022C4B48A000-memory.dmp
memory/4572-57-0x0000022C4B400000-0x0000022C4B42E000-memory.dmp
memory/4572-61-0x0000022C4B430000-0x0000022C4B442000-memory.dmp
memory/4572-62-0x0000022C63DF0000-0x0000022C63E16000-memory.dmp
memory/4572-60-0x0000022C4B210000-0x0000022C4B220000-memory.dmp
memory/4572-65-0x0000022C4B440000-0x0000022C4B448000-memory.dmp
memory/4572-66-0x0000022C643E0000-0x0000022C643E8000-memory.dmp
memory/4572-64-0x0000022C4B490000-0x0000022C4B498000-memory.dmp
memory/4572-63-0x0000022C4B450000-0x0000022C4B45A000-memory.dmp
memory/4572-80-0x0000000140000000-0x0000000140125000-memory.dmp
memory/4572-81-0x0000022C64BA0000-0x0000022C64C04000-memory.dmp
memory/4572-84-0x0000000140000000-0x0000000140125000-memory.dmp
memory/4572-85-0x0000000140000000-0x0000000140125000-memory.dmp
memory/4572-86-0x00007FFAC16B0000-0x00007FFAC2054000-memory.dmp
memory/4572-88-0x00007FFAC16B0000-0x00007FFAC2054000-memory.dmp
memory/4572-89-0x00007FFAC16B0000-0x00007FFAC2054000-memory.dmp