f38cbbacfd9bf820de91440b36821e2075a244e9c317b39149760996a11de27f

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/10/2026, 23:04

Target
2026-10-12_adae088533461cab0c3dc33c0d65a37b_akira_cobalt-strike_coinminer_glassworm_satacom_vidar.exe
Size 43.7MB
Sample261013-22dwbsst2p
SHA256 f38cbbacfd9bf820de91440b36821e2075a244e9c317b39149760996a11de27f
MD5 adae088533461cab0c3dc33c0d65a37b
SHA1 dcc69fe59d016d73d51b4a93baaaa790fb575455
SHA512 34f1f9fd2b5dbf14954915d8541f1b7c9f7a749159d3692b59033e8b0f36616d6d5de76c5cd34473c2e93556656aa970a343e77fdb47a77c26527be40a4820eb
SSDEEP 393216:VgO4B50AYuKau2HdySu4hVUlbbtqbzpjJF5zjwX:VgO4sIU2Hdl5zjW
TLSH
T1E8A75C97629810DDD1AAE2F9CB1A8D03F671744A033587DB07D0DAA72FA76E09E7D310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4112	2026-10-12_adae088533461cab0c3dc33c0d65a37b_akira_cobalt-strike_coinminer_glassworm_satacom_vidar.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4112	2026-10-12_adae088533461cab0c3dc33c0d65a37b_akira_cobalt-strike_coinminer_glassworm_satacom_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 3176	4112	2026-10-12_adae088533461cab0c3dc33c0d65a37b_akira_cobalt-strike_coinminer_glassworm_satacom_vidar.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-10-12_adae088533461cab0c3dc33c0d65a37b_akira_cobalt-strike_coinminer_glassworm_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-12_adae088533461cab0c3dc33c0d65a37b_akira_cobalt-strike_coinminer_glassworm_satacom_vidar.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Users\Admin\AppData\Local\Temp\2026-10-12_adae088533461cab0c3dc33c0d65a37b_akira_cobalt-strike_coinminer_glassworm_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-12_adae088533461cab0c3dc33c0d65a37b_akira_cobalt-strike_coinminer_glassworm_satacom_vidar.exe" --type=collab-renderer --proc=4112
  2⤵
  PID:3176