0369e0dbd04811fcd16fd8515a219130a8145be03d525ddb5a78bbed6b2344ab

Analysis

max time kernel
149s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/10/2026, 19:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_c075a8ca2d66775ee37b2ce27c3bc863_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Size 13.2MB
Sample261029-x8rnjset9s
SHA256 0369e0dbd04811fcd16fd8515a219130a8145be03d525ddb5a78bbed6b2344ab
MD5 c075a8ca2d66775ee37b2ce27c3bc863
SHA1 fbb98ebb160967291d84840c12cf9efddc465d5f
SHA512 cc7d58748f31691700249c7e8e680d16614643d46c189230214c2a2c4813891cb2f55f49efc3d9c6cac5e61c5e1f88605278978abc1d8e25401348e7c4f9f8aa
SSDEEP 196608:7M/uClEPJMKwvYinAbOEDwyfku+0YaYV:7M/uClEPJMfY2ODwvu45V
TLSH
T1F6D64A1A22E802D8E1B7C17CCA96DA02DAF27D194F21D7CF06A45B5A1F33AD44D7A731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-28_c075a8ca2d66775ee37b2ce27c3bc863_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-28_c075a8ca2d66775ee37b2ce27c3bc863_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-28_c075a8ca2d66775ee37b2ce27c3bc863_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_c075a8ca2d66775ee37b2ce27c3bc863_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:3500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

update_apps.json

Path C:\Users\Admin\AppData\Local\LGLData\applications\update_apps.json
Size 203B
SHA256 b41bed40e7847cc4f91b5918f011309de6ab01faa99ccf86443d29ad7e1bb512
MD5 13e25a000b0a01818e4fd3e04a9cc097
SHA1 d6a445a6933deffca94055324fd3c0ab080b3683
SHA512 33a8bbf2f6933a90cf98dcc9049fe900945b99d3940977043e5b7bb76e4ffe5ea27fb75180067b4bc99e76fe637dba40cc8b6583406ece647ae0cf4c16b538e9
TLSH
T1C9D012D461A718C751CA932E511CC7C24B7E622E75A4DD6E3796E304010C93E195BB5C
MD5 SHA1 SHA512 TLSH

Submit Download