Overview

overview

9

Static

static

5

2026-05-10...om.exe

windows10-2004-x64

9

2026-05-10...om.exe

windows11-21h2-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    10/05/2026, 16:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-10_f6fa8aa8847b75e39405126eb8fcde4e_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
  • Size 3.9MB
  • Sample260510-vffdpsbz4s
  • SHA256 a5250859d725203e11207e515b178f8045778bb9a0cbd57517497eb879be486d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecutionpersistencespywarestealer

Malware Config

Signatures

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 2 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
  • Enumerates VirtualBox registry keys 2 TTPs 3 IoCs
    defense_evasion
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    defense_evasion
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
    defense_evasion
  • Executes dropped EXE 4 IoCs
  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-10_f6fa8aa8847b75e39405126eb8fcde4e_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-10_f6fa8aa8847b75e39405126eb8fcde4e_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"
    1⤵
    • Enumerates VirtualBox registry keys
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Identifies Wine through registry keys
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3176
    • C:\Users\Admin\AppData\Local\MsNetCache\dns_sd64.exe
      "C:\Users\Admin\AppData\Local\MsNetCache\dns_sd64.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:3212
    • C:\Windows\System32\Wbem\mofcomp.exe
      mofcomp.exe "C:\Users\Admin\AppData\Local\Temp\_wd.mof"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3708
    • C:\Windows\System32\Wbem\mofcomp.exe
      mofcomp.exe "C:\Users\Admin\AppData\Local\Temp\_ws.mof"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3520
    • C:\Windows\system32\schtasks.exe
      "schtasks" /create /tn \Microsoft\Windows\WindowsUpdate\AutoUpdate /tr C:\Users\Admin\AppData\Local\MsNetCache\dns_sd64.exe /sc ONLOGON /ru SYSTEM /rl HIGHEST /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2856
  • C:\ProgramData\Microsoft\NetPerformanceLog\dns_sd64.exe
    C:\ProgramData\Microsoft\NetPerformanceLog\dns_sd64.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    PID:3216
  • C:\ProgramData\Microsoft\NetPerformanceLog\MsTokenSvc.exe
    C:\ProgramData\Microsoft\NetPerformanceLog\MsTokenSvc.exe
    1⤵
    • Executes dropped EXE
    PID:3324
  • C:\Users\Admin\AppData\Local\MsNetCache\dns_sd64.exe
    C:\Users\Admin\AppData\Local\MsNetCache\dns_sd64.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    PID:2084

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Defense Evasion

        Modify Registry

        1
        T1112

        Virtualization/Sandbox Evasion

        4
        T1497

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Browser Information Discovery

        1
        T1217

        Query Registry

        6
        T1012

        Virtualization/Sandbox Evasion

        4
        T1497

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        MsTokenSvc.exe
        • Path C:\ProgramData\Microsoft\NetPerformanceLog\MsTokenSvc.exe
        • Size 191KB
        • SHA256 45b7711677e417847a8c6fb4d618054fa437999cc22a678ddf083afb697ede27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        config.dat
        • Path C:\Users\Admin\AppData\Local\MsNetCache\config.dat
        • Size 320KB
        • SHA256 5e324ff3a5d3dd36d306c16ca307175f4eb9689ea87d8b640e5d54c680548bbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dns_sd64.exe
        • Path C:\Users\Admin\AppData\Local\MsNetCache\dns_sd64.exe
        • Size 116KB
        • SHA256 319f8de530c43ef2c0b5d4226ffdf2737c3a9c35dbc7efb8ebfc3312b5dac552
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dnssd.dll
        • Path C:\Users\Admin\AppData\Local\MsNetCache\dnssd.dll
        • Size 349KB
        • SHA256 e488f6ecac9afbb03436d7dddb6db59b4dcfebeb3bcce7eaf197c1cff8719ea7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wd.mof
        • Path C:\Users\Admin\AppData\Local\Temp\_wd.mof
        • Size 349B
        • SHA256 4893ece6669058bf6e2c3655ccba8f00ef61158457451929e78cbc64d0deee01
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        _ws.mof
        • Path C:\Users\Admin\AppData\Local\Temp\_ws.mof
        • Size 516B
        • SHA256 1e0e65be41790b02c1a81673653b226b973389077278092fe80d7c0d5621c4f6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/3212-22-0x00000000019C0000-0x0000000001A16000-memory.dmp
        Download

        memory/3212-50-0x00000000019C0000-0x0000000001A16000-memory.dmp
        Download