Overview

overview

3

Static

static

3

2026-10-20...er.exe

windows10-2004-x64

1

2026-10-20...er.exe

windows11-ltsc_2024-x64

1

Analysis

  • max time kernel
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/10/2026, 06:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-20_6d3071ea035f5c4b46344402d3c41f4a_akira_cobalt-strike_glassworm_rusty-stealer.exe
  • Size 35.0MB
  • Sample261020-g8hsmsd12v
  • SHA256 3d53ebee6c7761f109da52c7ba0bb14b94d30180a42d2ba857900b3cb554c888
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-20_6d3071ea035f5c4b46344402d3c41f4a_akira_cobalt-strike_glassworm_rusty-stealer.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-20_6d3071ea035f5c4b46344402d3c41f4a_akira_cobalt-strike_glassworm_rusty-stealer.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5928
    • C:\Users\Admin\AppData\Local\Temp\2026-10-20_6d3071ea035f5c4b46344402d3c41f4a_akira_cobalt-strike_glassworm_rusty-stealer.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-10-20_6d3071ea035f5c4b46344402d3c41f4a_akira_cobalt-strike_glassworm_rusty-stealer.exe" --exact fixture_app_data_starts_empty --test-threads 1
      2⤵
        PID:3360
      • C:\Users\Admin\AppData\Local\Temp\2026-10-20_6d3071ea035f5c4b46344402d3c41f4a_akira_cobalt-strike_glassworm_rusty-stealer.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-10-20_6d3071ea035f5c4b46344402d3c41f4a_akira_cobalt-strike_glassworm_rusty-stealer.exe" production_logging::privacy_tests::rust_log_cannot_lower_dependency_targets_onto_the_file_sink --exact --test-threads=1
        2⤵
          PID:908
        • C:\Users\Admin\AppData\Local\Temp\2026-10-20_6d3071ea035f5c4b46344402d3c41f4a_akira_cobalt-strike_glassworm_rusty-stealer.exe
          "C:\Users\Admin\AppData\Local\Temp\2026-10-20_6d3071ea035f5c4b46344402d3c41f4a_akira_cobalt-strike_glassworm_rusty-stealer.exe" production_logging::privacy_tests::the_release_panic_hook_keeps_the_message_and_location_out_of_every_sink --exact --test-threads=1 --nocapture
          2⤵
            PID:1240
          • C:\Users\Admin\AppData\Local\Temp\2026-10-20_6d3071ea035f5c4b46344402d3c41f4a_akira_cobalt-strike_glassworm_rusty-stealer.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-10-20_6d3071ea035f5c4b46344402d3c41f4a_akira_cobalt-strike_glassworm_rusty-stealer.exe" --exact fixture_app_data_starts_empty --test-threads 1
            2⤵
              PID:5652

          Network

                MITRE ATT&CK Matrix

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                .run
                • Path C:\Users\Admin\AppData\Local\Temp\mv-b200-retry-5928\test-artifacts\flow_cloud_stt-attempt2\.run
                • Size 21B
                • SHA256 4ee11d8acb14b098d3c4ae638ff91d1bb0b622b2806d75875b7fb4f00e6b29ed
                • MD5 SHA1 SHA512
                Submit Download

                app.log
                • Path C:\Users\Admin\AppData\Local\Temp\mv-b200-retry-5928\test-artifacts\flow_cloud_stt-attempt2\app.log
                • Size 111B
                • SHA256 abc4c63424937f2e9d1b584364987400e32c33bba4bfb0c9cf15f7e73577f408
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                meeting-vault.db
                • Path C:\Users\Admin\AppData\Local\Temp\mv-b200-retry-5928\test-artifacts\flow_cloud_stt-attempt2\attempt-probe\meeting-vault.db
                • Size 488KB
                • SHA256 dc536ecbbfbe2c87d9f3078a070e1c777682863b34a6dbc7e95f83fd13c98fbe
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                meeting-vault.db-wal
                • Path C:\Users\Admin\AppData\Local\Temp\mv-b200-retry-5928\test-artifacts\flow_cloud_stt-attempt2\attempt-probe\meeting-vault.db-wal
                • Size 32KB
                • SHA256 fd94356034fe14833eb1e22dd6c9f8aa310afad127923329b01c2904a7d68235
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                keys.txt
                • Path C:\Users\Admin\AppData\Local\Temp\mv-b200-retry-5928\test-artifacts\flow_cloud_stt-attempt2\keys.txt
                • Size 71B
                • SHA256 8f7775c825cf1f6798963fe2650254f31c0be33422ff0b3f94e9a19f14a2aba2
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                app.log
                • Path C:\Users\Admin\AppData\Local\Temp\mv-b200-retry-5928\test-artifacts\flow_cloud_stt\app.log
                • Size 111B
                • SHA256 044790cc3f60dde660ad54408e436b6adcccdf0374e5fe4fbaeaef47537a6c0b
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                meeting-vault.db-wal
                • Path C:\Users\Admin\AppData\Local\Temp\mv-b200-retry-5928\test-artifacts\flow_cloud_stt\attempt-probe\meeting-vault.db-wal
                • Size 32KB
                • SHA256 a8edcd88d3efc86db9853e16d61e4e51d048624585834aaffc8fdb677bfbb205
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                mv-template-db-42-57bfaf8d2cdfb4e7.db
                • Path C:\Users\Admin\AppData\Local\Temp\mv-template-db-42-57bfaf8d2cdfb4e7.db
                • Size 488KB
                • SHA256 77feec8a481d990e74efd1a5a61245a092806bb6481a0d3705902e7971c2478f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download