2d234a82574b89bea76bcba91c13da2fc4c312d24e6b09ae9c049a5bc87780e0

Analysis

max time kernel
149s
max time network
132s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_168c723902bd1c63cc0e040418dec895_akira_cobalt-strike_rusty-stealer_satacom.exe
Size 11.8MB
Sample260511-e4hkzabt2y
SHA256 2d234a82574b89bea76bcba91c13da2fc4c312d24e6b09ae9c049a5bc87780e0
MD5 168c723902bd1c63cc0e040418dec895
SHA1 fb905822cbab4b9d6228c6f2174cabbe8c781e7a
SHA512 5a1644faee6742f48e4faddd091009337e3a31368206df98ebb6861e902f652f781764a7e45d09a38b419829bc7a6721c432ae29960f602afd875e7f105ebdc2
SSDEEP 196608:sKRBsJrJZ/mGVkdojwiZJHYWmFzkalZ+Cx:lrsZJZHkYw4HcVkalECx
TLSH
T174C67D5852C391A783D39077DD726291267E6C9A524634072CFFE12C10B82E5E3FBADE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery execution persistence spyware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1368	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
2852	~tmp6a015b32.exe
1364	StateManager.exe
2704	CacheMgr.exe
3932	StateManager.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Windows\CurrentVersion\Run\StateManager = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\AppReadiness\\StateManager.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Windows\CurrentVersion\Run\CacheMgr = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Caches\\CacheMgr.exe\""	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	~tmp6a015b32.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2548	cmd.exe
5852	PING.EXE

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	~tmp6a015b32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\~tmp6a015b32.exe = "11001"	~tmp6a015b32.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
1984	reg.exe
4664	reg.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5852	PING.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2704	CacheMgr.exe
3932	StateManager.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1368	powershell.exe
1368	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1368	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2852	2504	2026-05-11_168c723902bd1c63cc0e040418dec895_akira_cobalt-strike_rusty-stealer_satacom.exe	79
PID 2504 wrote to memory of 1984	2504	2026-05-11_168c723902bd1c63cc0e040418dec895_akira_cobalt-strike_rusty-stealer_satacom.exe	80
PID 1364 wrote to memory of 5212	1364	StateManager.exe	84
PID 1364 wrote to memory of 5664	1364	StateManager.exe	85
PID 1364 wrote to memory of 4664	1364	StateManager.exe	86
PID 1364 wrote to memory of 4324	1364	StateManager.exe	90
PID 1364 wrote to memory of 2548	1364	StateManager.exe	91
PID 2548 wrote to memory of 5852	2548	cmd.exe	94
PID 2880 wrote to memory of 2704	2880	explorer.exe	95
PID 2504 wrote to memory of 2268	2504	2026-05-11_168c723902bd1c63cc0e040418dec895_akira_cobalt-strike_rusty-stealer_satacom.exe	96
PID 4496 wrote to memory of 3932	4496	explorer.exe	98
PID 3932 wrote to memory of 1368	3932	StateManager.exe	99

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5664	attrib.exe
5212	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-11_168c723902bd1c63cc0e040418dec895_akira_cobalt-strike_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_168c723902bd1c63cc0e040418dec895_akira_cobalt-strike_rusty-stealer_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Users\Admin\AppData\Local\Temp\~tmp6a015b32.exe
  "C:\Users\Admin\AppData\Local\Temp\~tmp6a015b32.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  PID:2852
- C:\Windows\system32\reg.exe
  "reg" add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v StateManager /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AppReadiness\StateManager.exe /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:1984
- C:\Windows\explorer.exe
  "explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AppReadiness\StateManager.exe
  2⤵
  PID:2268

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AppReadiness\StateManager.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AppReadiness\StateManager.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\system32\attrib.exe
  "attrib" +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Caches\CacheMgr.exe
  2⤵
  - Views/modifies file attributes
  PID:5212
- C:\Windows\system32\attrib.exe
  "attrib" +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Caches
  2⤵
  - Views/modifies file attributes
  PID:5664
- C:\Windows\system32\reg.exe
  "reg" add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v CacheMgr /t REG_SZ /d \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Caches\CacheMgr.exe\" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:4664
- C:\Windows\explorer.exe
  "explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Caches\CacheMgr.exe
  2⤵
  PID:4324
- C:\Windows\system32\cmd.exe
  "cmd" /c ping 127.0.0.1 -n 2 >nul & del /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AppReadiness\StateManager.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5852

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Caches\CacheMgr.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Caches\CacheMgr.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  PID:2704

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AppReadiness\StateManager.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AppReadiness\StateManager.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of WriteProcessMemory
  PID:3932
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -NoP -W Hidden -C "Copy-Item 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AppReadiness\StateManager.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Caches\CacheMgr.exe' -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_4iimejbf.mpk.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4iimejbf.mpk.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

~tmp6a015b32.exe

Path C:\Users\Admin\AppData\Local\Temp\~tmp6a015b32.exe
Size 7.3MB
SHA256 3d20655679c8829a6baad001851905927ef1b826e3eea594b7be3f8331211e39
MD5 e9d48daf4748eee45abf308b85e88b71
SHA1 7d49960c966e22ac2df69c79a84c5c48e55b8560
SHA512 2132693d8d1db4171a60251946b73eed091991d48e1fa3f4c8bd32a6467f8c9d4a3ab6cb883b8113fa3df648b2bd0b2c0418a468356a998df4f0b288735a9255
SSDEEP 98304:6z16s9EwkidrwQwPdz9u/ZZmDZJErFXQbZT7wIX0T:6z16gBrd3gu/XmDZiF0t
TLSH
T1F576F84162D58064F1B32675697A2AB1467B7D215F38C8CFB68C6D1D0BB36D2E830F2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StateManager.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AppReadiness\StateManager.exe
Size 403KB
SHA256 9e3905141b7c7d24f53212e1392805a89273bf4d3020421e0161a46aef94f897
MD5 72127df13ff4438d8b3354bdf19fb1f2
SHA1 d97b08c441804e18db95f59c3bb1bd6a41f6ca0f
SHA512 7be08a41470ff37ebe08fed4e5a30aff2e9a81b518a763552ce2f73032d210d8167b77f47d4590bc14e0b987362f26baaee2e310d4df512cd8390ce4030e92bf
SSDEEP 6144:2ZZH+j6Xi66N4krRpmdBuA0qKPcVWp+Xl95u0edC2PsEb:aZA6HvdwrP8WpevzIs
TLSH
T12894AF167E8654BCD05BC435C35786636A36B4CB0B21B8EF02D9E1342F69AF52F39B24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1364-72-0x0000024847CE0000-0x0000024847E00000-memory.dmp

Download

memory/1368-82-0x00000264DB4B0000-0x00000264DB4D2000-memory.dmp

Download

memory/1368-86-0x00000264DB210000-0x00000264DB21C000-memory.dmp

Download

memory/1368-87-0x00000264DB440000-0x00000264DB452000-memory.dmp

Download

memory/2504-74-0x000001CE3B8D0000-0x000001CE3B9F0000-memory.dmp

Download

memory/2704-88-0x000001D3EE0E0000-0x000001D3EE200000-memory.dmp

Download

memory/2852-83-0x0000000002F80000-0x0000000002FE4000-memory.dmp

Download

memory/3932-89-0x00000263644E0000-0x0000026364600000-memory.dmp

Download