c951bb5d234c72f121e5dc4d503fe8a7e590b5de9ab8440531a5387b741d9974

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/05/2026, 03:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-03_58515b65979252e230203727326c47f9_akira_cobalt-strike_rusty-stealer_satacom.exe
Size 4.3MB
Sample260503-d5a2vaex5p
SHA256 c951bb5d234c72f121e5dc4d503fe8a7e590b5de9ab8440531a5387b741d9974
MD5 58515b65979252e230203727326c47f9
SHA1 5072db4e1babfc391e6964980ae2a363dcaacba9
SHA512 994c447a10f8d87f050c81f13d4113947a3b7c3ca7671aaa28c1dd5abf0eb5b2b782728ada3bb8342dabcf9cdd91dfdcfc09be5474d4c42643b2556452c31969
SSDEEP 49152:AMdUYpowBZGeDSBREyqdwOM3Y4hiX2d2b/XsKK+tAWfBzvBTCJPn:AbWrTy++dhimd2j8K71BzvBTCJv
TLSH
T136262A5952C35167C3D39077E9725751267E6C9E134A300278FFE22C10B82E6E3EBADA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1800	~tmp69f6c267.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 732	756	2026-05-03_58515b65979252e230203727326c47f9_akira_cobalt-strike_rusty-stealer_satacom.exe	84
PID 756 wrote to memory of 4508	756	2026-05-03_58515b65979252e230203727326c47f9_akira_cobalt-strike_rusty-stealer_satacom.exe	86
PID 1756 wrote to memory of 1800	1756	explorer.exe	88

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
732	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-03_58515b65979252e230203727326c47f9_akira_cobalt-strike_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-03_58515b65979252e230203727326c47f9_akira_cobalt-strike_rusty-stealer_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:756
- C:\Windows\system32\attrib.exe
  "attrib" +h C:\Users\Admin\AppData\Local\Temp\~tmp69f6c267.exe
  2⤵
  - Views/modifies file attributes
  PID:732
- C:\Windows\explorer.exe
  "explorer.exe" \\?\C:\Users\Admin\AppData\Local\Temp\~tmp69f6c267.exe
  2⤵
  PID:4508

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Users\Admin\AppData\Local\Temp\~tmp69f6c267.exe
  "C:\Users\Admin\AppData\Local\Temp\~tmp69f6c267.exe"
  2⤵
  - Executes dropped EXE
  PID:1800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

~tmp69f6c267.exe

Path C:\Users\Admin\AppData\Local\Temp\~tmp69f6c267.exe
Size 1.6MB
SHA256 16cbe40fb24ce2d422afddb5a90a5801ced32ef52c22c2fc77b25a90837f28ad
MD5 36e31f610eef3223154e6e8fd074190f
SHA1 1f2800382cd71163c10e5ce0a32b60297489fbb5
SHA512 6971943ccf351e480745362a4c589bd0b3e07a86f76aa77831fd1bfa9c701aadcb4efe97ae4baa0558980e2309a5ff4fce42172b836955f073a15512a6486f0f
SSDEEP 49152:9xKA15VC4s6BwJQRVp5r6vzCpJXXiILleQd:97GCp53P
TLSH
T18085AE17B29600EDC06EC17987565122FA71BC850730BADF17A8A7252E36FD06F3EB25
MD5 SHA1 SHA512 SSDEEP TLSH