ebfd8c1fd348201176166dd7c33409cb5fe26bf897202f75833d728c7d20b348

Analysis

max time kernel
149s
max time network
129s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
21/04/2026, 23:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-21_a77e7e6909851e3b4f1d0e4eea947cc6_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
Size 1.8MB
Sample260421-3bs31ahs3x
SHA256 ebfd8c1fd348201176166dd7c33409cb5fe26bf897202f75833d728c7d20b348
MD5 a77e7e6909851e3b4f1d0e4eea947cc6
SHA1 dabd395aca140fd0afe4d161f28e29b1426ca04e
SHA512 515d6a9a90b415f3f175bdd61a456176fce9d13ff54c1d5d79033dcad8f69cf903a0cd2401286cfaedfbfbbb2745fce904ce4046348e0222a385cce56d2900e4
SSDEEP 24576:I9Bb6Nd5wLfSHm/kK+RwzvuYpsRSRiGWeAF2ZfKR7Y92rk22kgm6:7Efh/k7JCq8ib3tR7Y92Hrg5
TLSH
T11B95DF25FE1DBA75C128CA308A5E82359CABF55A074063D703F12DAD3E10EB9AF7D548
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4012	mscald.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mscald.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 4012	5048	2026-04-21_a77e7e6909851e3b4f1d0e4eea947cc6_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	78

C:\Users\Admin\AppData\Local\Temp\2026-04-21_a77e7e6909851e3b4f1d0e4eea947cc6_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-21_a77e7e6909851e3b4f1d0e4eea947cc6_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Users\Admin\AppData\Local\Temp\Microsoft\Diagnostics\mscald.exe
  C:\Users\Admin\AppData\Local\Temp\Microsoft\Diagnostics\mscald.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mscald.exe

Path C:\Users\Admin\AppData\Local\Temp\Microsoft\Diagnostics\mscald.exe
Size 1.4MB
SHA256 0d5df3bed16e27ccb2bda790af42d39530b5b7395ecbfeb3d16f5db0ebd5bb4e
MD5 900bf0be3cdda424d4a612cd65fca16c
SHA1 db7a25a6e6799bd406f1b3ec818795829238ae6f
SHA512 44ec731d11e5fe39ebbeebabffcc8a17022138452f1e842fcfc54099c72427f70d65ff303b6bfef2f61568d4ce0d64ea681f11110f6f8d1bb6f5b5a1f2e01e50
SSDEEP 24576:HzOec2H5kdUJVdXPJCeKzYh6P9/mxO1S1mKTHmai8Z/YGdyCJAOAfgy3Y3EonLl:Fc2H5kEVlPnKzY69/mxO1NKDmai8ZOCh
TLSH
T1C8658D41BCA12D9AD967217440EFE339AB791D060123DFE38A7AAD70AF177527E4C306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4012-7-0x0000000000E50000-0x0000000000F56000-memory.dmp

Download