Analysis
- max time kernel
149s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
04/05/2026, 10:56
General
- Target 2026-05-04_c560eb342f12ead0d73d357996898ff3_akira_cobalt-strike_rusty-stealer_satacom.exe
- Size 10.0MB
- Sample260504-m1636ads7j
- SHA256 be36b1f5405363efce0ef48fa391df6e7247f90e9483a56fb22f5bd3ea5fd267
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 5 IoCs
- Loads dropped DLL 21 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_c560eb342f12ead0d73d357996898ff3_akira_cobalt-strike_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-04_c560eb342f12ead0d73d357996898ff3_akira_cobalt-strike_rusty-stealer_satacom.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"cmd" /c start "" \\?\C:\Users\Admin\AppData\Local\Temp\~tmp69f87b82.exe2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~tmp69f87b82.exe"C:\Users\Admin\AppData\Local\Temp\~tmp69f87b82.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e872478f85ba06fc3e\vs_bootstrapper_d15\vs_setup_bootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\e872478f85ba06fc3e\vs_bootstrapper_d15\vs_setup_bootstrapper.exe" --env "_SFX_CAB_EXE_PACKAGE:C:\Users\Admin\AppData\Local\Temp\~tmp69f87b82.exe _SFX_CAB_EXE_ORIGINALWORKINGDIR:C:\Users\Admin\AppData\Local\Temp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\getmac.exe"getmac"5⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\explorer.exe"explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemResources\ResourceHost.exe2⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemResources\ResourceHost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemResources\ResourceHost.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemResources\ResourceHost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemResources\ResourceHost.exe"1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\IdentityCRL\IdentityCRL.exe"C:\Users\Admin\AppData\Roaming\Microsoft\IdentityCRL\IdentityCRL.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
vs_setup_bootstrapper_202605041157117612.json
20260504105744_4ab66152b2ba4d6bb555315d1ce5c8ad.trn
Microsoft.C2RSignatureReader.Interop.dll
Microsoft.C2RSignatureReader.Native.dll
Microsoft.VisualStudio.RemoteControl.dll
Microsoft.VisualStudio.Setup.Common.dll
Microsoft.VisualStudio.Setup.Download.dll
Microsoft.VisualStudio.Setup.dll
Microsoft.VisualStudio.Telemetry.dll
Microsoft.VisualStudio.Utilities.Internal.dll
Newtonsoft.Json.dll
System.Memory.dll
System.Runtime.CompilerServices.Unsafe.dll
detection.json
vs_setup_bootstrapper.config
vs_setup_bootstrapper.exe
vs_setup_bootstrapper.exe.config
~tmp69f87b82.exe
IdentityCRL.exe
memory/1480-252-0x00000000060E0000-0x00000000060E8000-memory.dmp
memory/1480-222-0x0000000005370000-0x000000000537A000-memory.dmp
memory/1480-266-0x0000000007300000-0x0000000007366000-memory.dmp
memory/1480-267-0x0000000007AD0000-0x0000000007B8A000-memory.dmp
memory/1480-264-0x00000000069D0000-0x00000000069F2000-memory.dmp
memory/1480-268-0x0000000007D30000-0x0000000007DC2000-memory.dmp
memory/1480-256-0x00000000066B0000-0x00000000066C0000-memory.dmp
memory/1480-244-0x00000000060B0000-0x00000000060C4000-memory.dmp
memory/1480-270-0x0000000008380000-0x0000000008924000-memory.dmp
memory/1480-226-0x0000000005850000-0x00000000058A2000-memory.dmp
memory/1480-248-0x0000000006310000-0x0000000006338000-memory.dmp
memory/1480-214-0x00000000057B0000-0x000000000584A000-memory.dmp
memory/1480-285-0x0000000006700000-0x0000000006719000-memory.dmp
memory/1480-210-0x0000000005390000-0x0000000005508000-memory.dmp
memory/1480-239-0x00000000063D0000-0x0000000006482000-memory.dmp
memory/1480-206-0x0000000000840000-0x0000000000894000-memory.dmp
memory/1480-284-0x0000000005A70000-0x0000000006023000-memory.dmp
memory/1480-265-0x0000000006A10000-0x0000000006D64000-memory.dmp
memory/1480-218-0x0000000005960000-0x0000000005A64000-memory.dmp
memory/1480-280-0x000000000B560000-0x000000000B598000-memory.dmp
memory/1480-277-0x000000000B210000-0x000000000B218000-memory.dmp
memory/1480-278-0x000000000B230000-0x000000000B238000-memory.dmp
memory/1480-279-0x000000000B250000-0x000000000B258000-memory.dmp
memory/1480-281-0x000000000B530000-0x000000000B53E000-memory.dmp
memory/2588-240-0x0000000001420000-0x0000000001B5F000-memory.dmp
memory/3156-286-0x0000000000920000-0x000000000105F000-memory.dmp
memory/3156-327-0x0000000000920000-0x000000000105F000-memory.dmp
memory/3344-290-0x00000224D0C10000-0x00000224D134F000-memory.dmp
memory/3400-234-0x0000020CA0910000-0x0000020CA104F000-memory.dmp
memory/3948-283-0x0000000004BB0000-0x0000000004C2E000-memory.dmp
memory/3948-282-0x0000000000DA0000-0x0000000001353000-memory.dmp
memory/4016-291-0x000002798F220000-0x000002798F95F000-memory.dmp
memory/4456-7-0x000002C1BE930000-0x000002C1BF06F000-memory.dmp
memory/5004-205-0x000002452D180000-0x000002452D8BF000-memory.dmp