f7dd03848cc93b3ab8349728bcc0a1e7801bd771affe5def2d6703e9d580d1a8

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/05/2026, 02:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-07_15b08cdc19672889e801900188969065_akira_cobalt-strike_rusty-stealer_satacom.exe
Size 390KB
Sample260507-cxtcsah14n
SHA256 f7dd03848cc93b3ab8349728bcc0a1e7801bd771affe5def2d6703e9d580d1a8
MD5 15b08cdc19672889e801900188969065
SHA1 31349c9add552a140dce41eb2692ba446e1ca189
SHA512 af75ec1664db5b3ba00dd023280455326ecd670c215d2e03dc22dc0c17675dbe1ca82030a667b0c58e9aa13192f39d377864bb46215116b342ab2b76b448b9f1
SSDEEP 12288:RZjAC39PodNZGod04tGsYs1eb+8o4F/p:RZ/I0zsYm8o
TLSH
T12784BF21FE9554B8D05BC434835687637A3274CE0B32B8EF02E991342F6AAF16F39B15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2824	WUSvcCheck.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2824	WUSvcCheck.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 4736	4732	2026-05-07_15b08cdc19672889e801900188969065_akira_cobalt-strike_rusty-stealer_satacom.exe	86
PID 4732 wrote to memory of 5760	4732	2026-05-07_15b08cdc19672889e801900188969065_akira_cobalt-strike_rusty-stealer_satacom.exe	87
PID 4732 wrote to memory of 5368	4732	2026-05-07_15b08cdc19672889e801900188969065_akira_cobalt-strike_rusty-stealer_satacom.exe	88
PID 4732 wrote to memory of 2716	4732	2026-05-07_15b08cdc19672889e801900188969065_akira_cobalt-strike_rusty-stealer_satacom.exe	89
PID 5500 wrote to memory of 2824	5500	explorer.exe	94

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4736	attrib.exe
5760	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-07_15b08cdc19672889e801900188969065_akira_cobalt-strike_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-07_15b08cdc19672889e801900188969065_akira_cobalt-strike_rusty-stealer_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Windows\system32\attrib.exe
  "attrib" +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsUpdate\WUSvcCheck.exe
  2⤵
  - Views/modifies file attributes
  PID:4736
- C:\Windows\system32\attrib.exe
  "attrib" +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsUpdate
  2⤵
  - Views/modifies file attributes
  PID:5760
- C:\Windows\system32\reg.exe
  "reg" add SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v WUSvcCheck /t REG_SZ /d \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsUpdate\WUSvcCheck.exe\" /f
  2⤵
  PID:5368
- C:\Windows\explorer.exe
  "explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsUpdate\WUSvcCheck.exe
  2⤵
  PID:2716

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:5500
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsUpdate\WUSvcCheck.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsUpdate\WUSvcCheck.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  PID:2824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WUSvcCheck.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsUpdate\WUSvcCheck.exe
Size 390KB
SHA256 f7dd03848cc93b3ab8349728bcc0a1e7801bd771affe5def2d6703e9d580d1a8
MD5 15b08cdc19672889e801900188969065
SHA1 31349c9add552a140dce41eb2692ba446e1ca189
SHA512 af75ec1664db5b3ba00dd023280455326ecd670c215d2e03dc22dc0c17675dbe1ca82030a667b0c58e9aa13192f39d377864bb46215116b342ab2b76b448b9f1
SSDEEP 12288:RZjAC39PodNZGod04tGsYs1eb+8o4F/p:RZ/I0zsYm8o
TLSH
T12784BF21FE9554B8D05BC434835687637A3274CE0B32B8EF02E991342F6AAF16F39B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2824-4-0x0000021AC1DE0000-0x0000021AC2135000-memory.dmp

Download

memory/4732-1-0x0000020074900000-0x0000020074C55000-memory.dmp