a9da184922fe33d88705a858efea04888166a29844720bef86d213229247e7f3

Analysis

max time kernel
149s
max time network
135s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/05/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-03_90af5344b51e545ce935af23e3f3b352_akira_cobalt-strike_rusty-stealer_satacom.exe
Size 4.2MB
Sample260503-ejryxabt8z
SHA256 a9da184922fe33d88705a858efea04888166a29844720bef86d213229247e7f3
MD5 90af5344b51e545ce935af23e3f3b352
SHA1 766905295987981b25b15d68a27ca066cd02d8c5
SHA512 a5813f6db79c3f1af8d6b1872d4cf397b50ce93b129be6ca86e503542446e5a7cbc684bd998934f26b7433063ac9f15ee867813c69fa2447df2d67a026b22844
SSDEEP 49152:ZKee0Dcy6xeyGE19vKzUdTaAbSl9h44JU8dKdETnZlsMe/9:ZKLxeyVKmVU964VdKUlsMe/
TLSH
T13A163A9952C35167C3D39077E9725651267E6C9E134A30027CFFD22C10B82E6E3EBADA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4968	~tmp69f6c7ec.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 4688	5012	2026-05-03_90af5344b51e545ce935af23e3f3b352_akira_cobalt-strike_rusty-stealer_satacom.exe	79
PID 5012 wrote to memory of 2800	5012	2026-05-03_90af5344b51e545ce935af23e3f3b352_akira_cobalt-strike_rusty-stealer_satacom.exe	81
PID 1836 wrote to memory of 4968	1836	explorer.exe	83

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4688	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-03_90af5344b51e545ce935af23e3f3b352_akira_cobalt-strike_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-03_90af5344b51e545ce935af23e3f3b352_akira_cobalt-strike_rusty-stealer_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Windows\system32\attrib.exe
  "attrib" +h C:\Users\Admin\AppData\Local\Temp\~tmp69f6c7ec.exe
  2⤵
  - Views/modifies file attributes
  PID:4688
- C:\Windows\explorer.exe
  "explorer.exe" \\?\C:\Users\Admin\AppData\Local\Temp\~tmp69f6c7ec.exe
  2⤵
  PID:2800

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Users\Admin\AppData\Local\Temp\~tmp69f6c7ec.exe
  "C:\Users\Admin\AppData\Local\Temp\~tmp69f6c7ec.exe"
  2⤵
  - Executes dropped EXE
  PID:4968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

~tmp69f6c7ec.exe

Path C:\Users\Admin\AppData\Local\Temp\~tmp69f6c7ec.exe
Size 1.6MB
SHA256 16cbe40fb24ce2d422afddb5a90a5801ced32ef52c22c2fc77b25a90837f28ad
MD5 36e31f610eef3223154e6e8fd074190f
SHA1 1f2800382cd71163c10e5ce0a32b60297489fbb5
SHA512 6971943ccf351e480745362a4c589bd0b3e07a86f76aa77831fd1bfa9c701aadcb4efe97ae4baa0558980e2309a5ff4fce42172b836955f073a15512a6486f0f
SSDEEP 49152:9xKA15VC4s6BwJQRVp5r6vzCpJXXiILleQd:97GCp53P
TLSH
T18085AE17B29600EDC06EC17987565122FA71BC850730BADF17A8A7252E36FD06F3EB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1836-5-0x0000000002150000-0x00000000021FF000-memory.dmp

Download

memory/1836-17-0x0000000002150000-0x00000000021FF000-memory.dmp

Download

memory/2800-3-0x0000000002460000-0x000000000250F000-memory.dmp

Download

memory/4968-6-0x0000013D0C750000-0x0000013D0C7EE000-memory.dmp

Download

memory/5012-4-0x000001BBC1EA0000-0x000001BBC1F3E000-memory.dmp

Download

memory/5012-8-0x000001BBC1EA0000-0x000001BBC1F3E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads