fe6793f9d6cd167b922e62b1b1eb24fcb632247b6ea281dac9704771ca017526

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 06:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_8542dbce018adabe49a0fcba91f9c949_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Size 76.3MB
Sample261024-gys6maxw2n
SHA256 fe6793f9d6cd167b922e62b1b1eb24fcb632247b6ea281dac9704771ca017526
MD5 8542dbce018adabe49a0fcba91f9c949
SHA1 cc6e5b5f7c12d96c9191f3ec91dd02ac7fab04a4
SHA512 ab7b7bdf340ead68c802ced3e0f864b03508b9a288d053527ff5ef2952f7e3d4f33f712c23cede9856bf5e034a57bb2b742efa3621d5607fdad45b4b5e9ea5b0
SSDEEP 393216:tAsN5fijNgTxNmDJdAJr/NYeerl/CAvYXJu1ZzlxlO7EnmvwjfIZVFxep8MI2w/I:tJUfzDIj20mvt5m6dG/ubi
TLSH
T14D085A6262AA05B5E9FFBA3495E24D13DE72BC076B3081CB3348173A1F736E09976711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	2026-10-22_8542dbce018adabe49a0fcba91f9c949_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	2026-10-22_8542dbce018adabe49a0fcba91f9c949_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 2152	1608	2026-10-22_8542dbce018adabe49a0fcba91f9c949_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-10-22_8542dbce018adabe49a0fcba91f9c949_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_8542dbce018adabe49a0fcba91f9c949_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Users\Admin\AppData\Local\Temp\2026-10-22_8542dbce018adabe49a0fcba91f9c949_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
  C:\Users\Admin\AppData\Local\Temp\2026-10-22_8542dbce018adabe49a0fcba91f9c949_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe C:\Users\Admin\AppData\Local\Temp\2026-10-22_8542dbce018adabe49a0fcba91f9c949_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
  2⤵
  - Checks computer location settings
  PID:2152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lucid_err.log

Path C:\Users\Admin\AppData\Local\Temp\lucid_err.log
Size 378B
SHA256 6f2577b8bad482eb15dd4aa2e2a03889aa7b2f26e68a17a61a0e3a2603700b94
MD5 58ef7d0dd9352f768c1e1b35e874cdae
SHA1 82ef457d9ce387b3a323e65d3f154a76936f8ee6
SHA512 6e1155b4b805f0dc4f787aad1fb932bf925a387405d4825d82f425ffb40edc6dd6ca436aefd5d7546602b49d311c2fe60de9b7fd6540ebc08f054afa769e849f
TLSH
T1DFE061883E13FCAA4730503C3C740FEC43CAE737880A23C961390A4F0B27810221F088
MD5 SHA1 SHA512 TLSH

Submit Download