Analysis
- max time kernel
149s - max time network
93s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
11/05/2026, 15:23
General
- Target 2026-05-11_ab1892e7171e173f3471b9986f4b0c0e_akira_cobalt-strike_rusty-stealer_satacom.exe
- Size 265KB
- Sample260511-sspf2agx2n
- SHA256 ce60f4779ed758f46fc30b2d488a23768b378624ef61a0f0bef7bdfd0dd86da6
Malware Config
Extracted
-
xworm
-
5.0
-
fdijfeuhfeuofjweoxhjy.anondns.net:6767
-
hEHq9gsDQgGSv23H
-
install_file
USB.exe
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Detects DonutLoader 3 IoCs
- Detects Windows executables referencing non-Windows User-Agents 1 IoCs
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_ab1892e7171e173f3471b9986f4b0c0e_akira_cobalt-strike_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_ab1892e7171e173f3471b9986f4b0c0e_akira_cobalt-strike_rusty-stealer_satacom.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\reg.exereg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Realtek Audio HD" /t REG_SZ /d "C:\Windows\System32\RtkAud\RtkAudUService32.exe" /f2⤵
- Adds Run key to start application
-
-
C:\Windows\System32\RtkAud\RtkAudUService32.exeC:\Windows\System32\RtkAud\RtkAudUService32.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RtkAudUService32.exe
memory/1184-2-0x000001B7E0000000-0x000001B7E0011000-memory.dmp
memory/1184-3-0x000001B7FA520000-0x000001B7FA530000-memory.dmp
memory/1184-4-0x000001B7E1A00000-0x000001B7E1A0E000-memory.dmp
memory/1184-5-0x000001B7FA520000-0x000001B7FA530000-memory.dmp
memory/1184-6-0x000001B7FA520000-0x000001B7FA530000-memory.dmp
memory/1184-10-0x000001B7E19E0000-0x000001B7E19EC000-memory.dmp
memory/3632-13-0x0000015DFBF40000-0x0000015DFBF50000-memory.dmp
memory/3632-15-0x0000015DE34D0000-0x0000015DE34DC000-memory.dmp