Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
11/05/2026, 15:23
General
- Target 2026-05-11_ab1892e7171e173f3471b9986f4b0c0e_akira_cobalt-strike_rusty-stealer_satacom.exe
- Size 265KB
- Sample260511-sspf2agx2n
- SHA256 ce60f4779ed758f46fc30b2d488a23768b378624ef61a0f0bef7bdfd0dd86da6
Malware Config
Extracted
-
xworm
-
5.0
-
fdijfeuhfeuofjweoxhjy.anondns.net:6767
-
hEHq9gsDQgGSv23H
-
install_file
USB.exe
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Detects DonutLoader 2 IoCs
- Detects Windows executables referencing non-Windows User-Agents 1 IoCs
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_ab1892e7171e173f3471b9986f4b0c0e_akira_cobalt-strike_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_ab1892e7171e173f3471b9986f4b0c0e_akira_cobalt-strike_rusty-stealer_satacom.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\reg.exereg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Realtek Audio HD" /t REG_SZ /d "C:\Windows\System32\RtkAud\RtkAudUService32.exe" /f2⤵
- Adds Run key to start application
-
-
C:\Windows\System32\RtkAud\RtkAudUService32.exeC:\Windows\System32\RtkAud\RtkAudUService32.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RtkAudUService32.exe
memory/2580-1-0x00000209090A0000-0x00000209090B1000-memory.dmp
memory/2580-3-0x0000020923640000-0x0000020923650000-memory.dmp
memory/2580-4-0x00000209091C0000-0x00000209091CE000-memory.dmp
memory/2580-6-0x0000020923640000-0x0000020923650000-memory.dmp
memory/2580-5-0x0000020923640000-0x0000020923650000-memory.dmp
memory/2580-10-0x00000209090D0000-0x0000020909100000-memory.dmp
memory/2580-11-0x00000209091A0000-0x00000209091AC000-memory.dmp
memory/3864-14-0x00000223A9E40000-0x00000223A9E50000-memory.dmp
memory/3864-15-0x00000223A9E40000-0x00000223A9E50000-memory.dmp
memory/3864-17-0x000002238FB00000-0x000002238FB30000-memory.dmp
memory/3864-18-0x0000022391380000-0x000002239138C000-memory.dmp