Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
04/05/2026, 10:56
General
- Target 2026-05-04_c560eb342f12ead0d73d357996898ff3_akira_cobalt-strike_rusty-stealer_satacom.exe
- Size 10.0MB
- Sample260504-m1636ads7j
- SHA256 be36b1f5405363efce0ef48fa391df6e7247f90e9483a56fb22f5bd3ea5fd267
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 21 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_c560eb342f12ead0d73d357996898ff3_akira_cobalt-strike_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-04_c560eb342f12ead0d73d357996898ff3_akira_cobalt-strike_rusty-stealer_satacom.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"cmd" /c start "" \\?\C:\Users\Admin\AppData\Local\Temp\~tmp69f87b7e.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~tmp69f87b7e.exe"C:\Users\Admin\AppData\Local\Temp\~tmp69f87b7e.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bb15f7a0043196ff3f98f273\vs_bootstrapper_d15\vs_setup_bootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\bb15f7a0043196ff3f98f273\vs_bootstrapper_d15\vs_setup_bootstrapper.exe" --env "_SFX_CAB_EXE_PACKAGE:C:\Users\Admin\AppData\Local\Temp\~tmp69f87b7e.exe _SFX_CAB_EXE_ORIGINALWORKINGDIR:C:\Users\Admin\AppData\Local\Temp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\getmac.exe"getmac"5⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\explorer.exe"explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemResources\ResourceHost.exe2⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemResources\ResourceHost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemResources\ResourceHost.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\IdentityCRL\IdentityCRL.exe"C:\Users\Admin\AppData\Roaming\Microsoft\IdentityCRL\IdentityCRL.exe"3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
vs_setup_bootstrapper_202605041157062340.json
20260504105738_5f81a6d0d2634cb397127205c80c1473.trn
Microsoft.C2RSignatureReader.Interop.dll
Microsoft.C2RSignatureReader.Native.dll
Microsoft.VisualStudio.RemoteControl.dll
Microsoft.VisualStudio.Setup.Common.dll
Microsoft.VisualStudio.Setup.Download.dll
Microsoft.VisualStudio.Setup.dll
Microsoft.VisualStudio.Telemetry.dll
Microsoft.VisualStudio.Utilities.Internal.dll
Newtonsoft.Json.dll
System.Memory.dll
System.Runtime.CompilerServices.Unsafe.dll
detection.json
vs_setup_bootstrapper.config
vs_setup_bootstrapper.exe
vs_setup_bootstrapper.exe.config
~tmp69f87b7e.exe
ResourceHost.exe
memory/244-231-0x0000000005D80000-0x0000000005D94000-memory.dmp
memory/244-203-0x00000000009C0000-0x0000000000A14000-memory.dmp
memory/244-243-0x0000000006390000-0x00000000063A0000-memory.dmp
memory/244-255-0x00000000066F0000-0x0000000006A47000-memory.dmp
memory/244-284-0x00000000063E0000-0x00000000063FA000-memory.dmp
memory/244-239-0x0000000005FE0000-0x0000000005FE8000-memory.dmp
memory/244-235-0x0000000005FF0000-0x0000000006018000-memory.dmp
memory/244-219-0x0000000005600000-0x000000000560A000-memory.dmp
memory/244-223-0x0000000005AE0000-0x0000000005B32000-memory.dmp
memory/244-227-0x0000000006080000-0x0000000006132000-memory.dmp
memory/244-215-0x0000000005BF0000-0x0000000005CF4000-memory.dmp
memory/244-211-0x0000000005A40000-0x0000000005ADA000-memory.dmp
memory/244-207-0x0000000005620000-0x0000000005798000-memory.dmp
memory/244-283-0x0000000006220000-0x0000000006227000-memory.dmp
memory/244-264-0x0000000006EF0000-0x0000000006FAA000-memory.dmp
memory/244-253-0x00000000066B0000-0x00000000066D2000-memory.dmp
memory/244-266-0x0000000007330000-0x0000000007396000-memory.dmp
memory/244-267-0x000000000A450000-0x000000000A4E2000-memory.dmp
memory/244-269-0x000000000ABD0000-0x000000000B176000-memory.dmp
memory/244-270-0x000000000A110000-0x000000000A118000-memory.dmp
memory/244-271-0x000000000A140000-0x000000000A148000-memory.dmp
memory/244-273-0x000000000A700000-0x000000000A70E000-memory.dmp
memory/244-272-0x000000000A9D0000-0x000000000AA08000-memory.dmp
memory/244-282-0x00000000059A0000-0x00000000059B9000-memory.dmp
memory/912-285-0x000002AAAC980000-0x000002AAACA2E000-memory.dmp
memory/912-314-0x000002AAAC980000-0x000002AAACA2E000-memory.dmp
memory/1464-254-0x000002743A2B0000-0x000002743A35E000-memory.dmp
memory/1632-263-0x000002837E500000-0x000002837E5AE000-memory.dmp
memory/3392-7-0x00000297EA8E0000-0x00000297EA98E000-memory.dmp