fe6793f9d6cd167b922e62b1b1eb24fcb632247b6ea281dac9704771ca017526

Analysis

max time kernel
150s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 06:13

Target
2026-10-22_8542dbce018adabe49a0fcba91f9c949_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
Size 76.3MB
Sample261024-gys6maxw2n
SHA256 fe6793f9d6cd167b922e62b1b1eb24fcb632247b6ea281dac9704771ca017526
MD5 8542dbce018adabe49a0fcba91f9c949
SHA1 cc6e5b5f7c12d96c9191f3ec91dd02ac7fab04a4
SHA512 ab7b7bdf340ead68c802ced3e0f864b03508b9a288d053527ff5ef2952f7e3d4f33f712c23cede9856bf5e034a57bb2b742efa3621d5607fdad45b4b5e9ea5b0
SSDEEP 393216:tAsN5fijNgTxNmDJdAJr/NYeerl/CAvYXJu1ZzlxlO7EnmvwjfIZVFxep8MI2w/I:tJUfzDIj20mvt5m6dG/ubi
TLSH
T14D085A6262AA05B5E9FFBA3495E24D13DE72BC076B3081CB3348173A1F736E09976711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 6108	5064	2026-10-22_8542dbce018adabe49a0fcba91f9c949_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-10-22_8542dbce018adabe49a0fcba91f9c949_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_8542dbce018adabe49a0fcba91f9c949_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Users\Admin\AppData\Local\Temp\2026-10-22_8542dbce018adabe49a0fcba91f9c949_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
  C:\Users\Admin\AppData\Local\Temp\2026-10-22_8542dbce018adabe49a0fcba91f9c949_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe C:\Users\Admin\AppData\Local\Temp\2026-10-22_8542dbce018adabe49a0fcba91f9c949_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_zxxz.exe
  2⤵
  PID:6108

lucid_err.log

Path C:\Users\Admin\AppData\Local\Temp\lucid_err.log
Size 378B
SHA256 ef545a3ee1a32d51abe1c26f8d9839f37e61b1e102cbf0412bad34b1657d223e
MD5 76440add06290ae37d1e3594b80c0be2
SHA1 673e146293423029248f77ea868fbf9b2c40401f
SHA512 b13ad0019ed2f9ad92aac3c886ae66c9d147e2bc300e1df36bd4ebbbd0634ffc03fd5dfaca4799e08540e0bf64b1e9bb1d093ca0c7dbc22da8db2d909e468845
TLSH
T171E022882E23F8EA4620403838740FAC0389DB23A80A23DA213A0A4E0B27820661E488
MD5 SHA1 SHA512 TLSH

Submit Download