f7dd03848cc93b3ab8349728bcc0a1e7801bd771affe5def2d6703e9d580d1a8

Analysis

max time kernel
149s
max time network
96s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/05/2026, 02:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-07_15b08cdc19672889e801900188969065_akira_cobalt-strike_rusty-stealer_satacom.exe
Size 390KB
Sample260507-cxtcsah14n
SHA256 f7dd03848cc93b3ab8349728bcc0a1e7801bd771affe5def2d6703e9d580d1a8
MD5 15b08cdc19672889e801900188969065
SHA1 31349c9add552a140dce41eb2692ba446e1ca189
SHA512 af75ec1664db5b3ba00dd023280455326ecd670c215d2e03dc22dc0c17675dbe1ca82030a667b0c58e9aa13192f39d377864bb46215116b342ab2b76b448b9f1
SSDEEP 12288:RZjAC39PodNZGod04tGsYs1eb+8o4F/p:RZ/I0zsYm8o
TLSH
T12784BF21FE9554B8D05BC434835687637A3274CE0B32B8EF02E991342F6AAF16F39B15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3196	WUSvcCheck.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3196	WUSvcCheck.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 2640	4864	2026-05-07_15b08cdc19672889e801900188969065_akira_cobalt-strike_rusty-stealer_satacom.exe	79
PID 4864 wrote to memory of 2596	4864	2026-05-07_15b08cdc19672889e801900188969065_akira_cobalt-strike_rusty-stealer_satacom.exe	80
PID 4864 wrote to memory of 2400	4864	2026-05-07_15b08cdc19672889e801900188969065_akira_cobalt-strike_rusty-stealer_satacom.exe	81
PID 4864 wrote to memory of 3124	4864	2026-05-07_15b08cdc19672889e801900188969065_akira_cobalt-strike_rusty-stealer_satacom.exe	82
PID 5396 wrote to memory of 3196	5396	explorer.exe	87

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2640	attrib.exe
2596	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-07_15b08cdc19672889e801900188969065_akira_cobalt-strike_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-07_15b08cdc19672889e801900188969065_akira_cobalt-strike_rusty-stealer_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Windows\system32\attrib.exe
  "attrib" +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsUpdate\WUSvcCheck.exe
  2⤵
  - Views/modifies file attributes
  PID:2640
- C:\Windows\system32\attrib.exe
  "attrib" +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsUpdate
  2⤵
  - Views/modifies file attributes
  PID:2596
- C:\Windows\system32\reg.exe
  "reg" add SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v WUSvcCheck /t REG_SZ /d \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsUpdate\WUSvcCheck.exe\" /f
  2⤵
  PID:2400
- C:\Windows\explorer.exe
  "explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsUpdate\WUSvcCheck.exe
  2⤵
  PID:3124

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:5396
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsUpdate\WUSvcCheck.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsUpdate\WUSvcCheck.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  PID:3196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WUSvcCheck.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsUpdate\WUSvcCheck.exe
Size 390KB
SHA256 f7dd03848cc93b3ab8349728bcc0a1e7801bd771affe5def2d6703e9d580d1a8
MD5 15b08cdc19672889e801900188969065
SHA1 31349c9add552a140dce41eb2692ba446e1ca189
SHA512 af75ec1664db5b3ba00dd023280455326ecd670c215d2e03dc22dc0c17675dbe1ca82030a667b0c58e9aa13192f39d377864bb46215116b342ab2b76b448b9f1
SSDEEP 12288:RZjAC39PodNZGod04tGsYs1eb+8o4F/p:RZ/I0zsYm8o
TLSH
T12784BF21FE9554B8D05BC434835687637A3274CE0B32B8EF02E991342F6AAF16F39B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3124-4-0x0000000001560000-0x0000000001D0E000-memory.dmp

Download

memory/3196-6-0x00000273AC2A0000-0x00000273ACA4E000-memory.dmp

Download

memory/4864-1-0x000001D561810000-0x000001D561FBE000-memory.dmp

Download

memory/5396-5-0x0000000000FF0000-0x000000000179E000-memory.dmp

Download

memory/5396-15-0x0000000000FF0000-0x000000000179E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads