Overview

overview

9

Static

static

3

2026-04-16...om.exe

windows10-2004-x64

9

2026-04-16...om.exe

windows11-21h2-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    94s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    16/04/2026, 03:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-16_87289f607954254b9a0cd130113090d5_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
  • Size 1.0MB
  • Sample260416-d5zefaat2x
  • SHA256 171ff884e1573d91db3f383cb3e417b6bcf3300d1d0be1fe4b59fe21dc4fe776
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasionexecutionimpactransomwarespywarestealer

Malware Config

Signatures

  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (601) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 3 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Kills process with taskkill 7 IoCs
    defense_evasion
  • Runs net.exe
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-16_87289f607954254b9a0cd130113090d5_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-16_87289f607954254b9a0cd130113090d5_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"
    1⤵
    • Enumerates connected drives
    • Suspicious use of WriteProcessMemory
    PID:5004
    • C:\Windows\system32\taskkill.exe
      "taskkill" /F /IM sqlbrowser.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2224
    • C:\Windows\system32\taskkill.exe
      "taskkill" /F /IM sqlservr.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2132
    • C:\Windows\system32\taskkill.exe
      "taskkill" /F /IM msmdsrv.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1764
    • C:\Windows\system32\taskkill.exe
      "taskkill" /F /IM Ssms.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:328
    • C:\Windows\system32\taskkill.exe
      "taskkill" /F /IM SQLAGENT.EXE
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2320
    • C:\Windows\system32\taskkill.exe
      "taskkill" /F /IM ReportingServicesService.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1276
    • C:\Windows\system32\taskkill.exe
      "taskkill" /F /IM postgres.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1456
    • C:\Windows\system32\cmd.exe
      "cmd" /c "net start VSS"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4392
      • C:\Windows\system32\net.exe
        net start VSS
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4640
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 start VSS
          4⤵
            PID:3948
      • C:\Windows\system32\cmd.exe
        "cmd" /c "vssadmin delete shadows /all /quiet"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:500
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          3⤵
          • Interacts with shadow copies
          PID:2308
      • C:\Users\Admin\AppData\Local\Temp\2026-04-16_87289f607954254b9a0cd130113090d5_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-04-16_87289f607954254b9a0cd130113090d5_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe" --target \\?\C:\
        2⤵
          PID:804
        • C:\Users\Admin\AppData\Local\Temp\2026-04-16_87289f607954254b9a0cd130113090d5_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
          "C:\Users\Admin\AppData\Local\Temp\2026-04-16_87289f607954254b9a0cd130113090d5_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe" --target \\?\F:\
          2⤵
            PID:5052
          • C:\Users\Admin\AppData\Local\Temp\2026-04-16_87289f607954254b9a0cd130113090d5_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-04-16_87289f607954254b9a0cd130113090d5_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe" --target \\?\E:\
            2⤵
              PID:3092
            • C:\Users\Admin\AppData\Local\Temp\2026-04-16_87289f607954254b9a0cd130113090d5_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
              "C:\Users\Admin\AppData\Local\Temp\2026-04-16_87289f607954254b9a0cd130113090d5_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe" --target \\?\G:\
              2⤵
                PID:5104
            • C:\Windows\system32\vssvc.exe
              C:\Windows\system32\vssvc.exe
              1⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:908

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  RANSOM_NOTE.html
                  • Path C:\Users\Admin\AppData\Local\Temp\RANSOM_NOTE.html
                  • Size 5KB
                  • SHA256 9382ea7bd3a957db2c102577dcdbe54da4247c15aba092870987ba8dc96ecc2c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  RANSOM_NOTE.html
                  • Path C:\Users\Admin\AppData\Local\Temp\RANSOM_NOTE.html
                  • Size 5KB
                  • SHA256 79b25439fd259a23a54080d82c093f1e28a60d9e7f01bbffb0738ca4ee91c661
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  rw_5052.json
                  • Path C:\Users\Admin\AppData\Local\Temp\rw_5052.json
                  • Size 61B
                  • SHA256 15ea54efd1fd8c945f114929587880d652f514d6aff3bdfd668be009b385e678
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  rw_804.json
                  • Path C:\Users\Admin\AppData\Local\Temp\rw_804.json
                  • Size 65B
                  • SHA256 8db8a516d601ad04d935456cd155faa274880147a23a2e264d7c025446023fb8
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  RANSOM_NOTE.html
                  • Path C:\Users\Admin\AppData\RANSOM_NOTE.html
                  • Size 5KB
                  • SHA256 de039080b00646a19364dd16422e13aa9e1aaa827fc73af214d399a64394933d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download