7041100421b8c2b95c5e71ff20967054df33af8ff72bb529afa9834376cb8493

General

Target
2026-04-21_b7c23a6062c6491086091793a6d9908d_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
Size 2.5MB
Sample260421-nnn79ag16w
SHA256 7041100421b8c2b95c5e71ff20967054df33af8ff72bb529afa9834376cb8493
MD5 b7c23a6062c6491086091793a6d9908d
SHA1 c701e0c053e6ad5b39a14e2b4e520382a9d1d9bb
SHA512 400b34991c3d0f15c6ed4dc59223142ff48b90af4c18ed808f5c637b83b9271c6d70c42438ca36883ef4892fc76356e83c6f8695cefc5f3c28839932620efd79
SSDEEP 49152:XwLgW0B2MXHgeGLzCnx7Rt80JjIGr2yXEJmgS/xcEIuaZ:XpW0jgeGLzkx9KAjcyTxe+q
TLSH
T18AC59E0AE15349D5CC6BC0BC838F7131EB357D79CA282D9B17D28B613A95B807725F8A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

credential_access discovery execution spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5072	powershell.exe

Checks processor information in registry 2 TTPs 1 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-04-21_b7c23a6062c6491086091793a6d9908d_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
5072	powershell.exe
5072	powershell.exe
5072	powershell.exe
4532	msedge.exe
4532	msedge.exe
1640	chrome.exe
1640	chrome.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5072	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3168 wrote to memory of 5072	3168	2026-04-21_b7c23a6062c6491086091793a6d9908d_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	79
PID 3168 wrote to memory of 4780	3168	2026-04-21_b7c23a6062c6491086091793a6d9908d_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	81
PID 3168 wrote to memory of 4780	3168	2026-04-21_b7c23a6062c6491086091793a6d9908d_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	81
PID 3168 wrote to memory of 4532	3168	2026-04-21_b7c23a6062c6491086091793a6d9908d_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	82
PID 3168 wrote to memory of 4532	3168	2026-04-21_b7c23a6062c6491086091793a6d9908d_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	82
PID 3168 wrote to memory of 1640	3168	2026-04-21_b7c23a6062c6491086091793a6d9908d_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	83
PID 3168 wrote to memory of 1640	3168	2026-04-21_b7c23a6062c6491086091793a6d9908d_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	83

C:\Users\Admin\AppData\Local\Temp\2026-04-21_b7c23a6062c6491086091793a6d9908d_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-21_b7c23a6062c6491086091793a6d9908d_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"
1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "Get-Process | Select-Object Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5072
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --headless --incognito
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1640

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4816

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_f432kg5f.jj1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_f432kg5f.jj1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5072-1-0x00000290C1C60000-0x00000290C1C70000-memory.dmp

Download

memory/5072-0-0x00000290C1C60000-0x00000290C1C70000-memory.dmp

Download

memory/5072-7-0x00000290C1AE0000-0x00000290C1B02000-memory.dmp

Download

memory/5072-9-0x00000290C1C60000-0x00000290C1C70000-memory.dmp

Download

memory/5072-12-0x00000290C1A70000-0x00000290C1A82000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads