Analysis
- max time kernel
148s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
17/05/2026, 09:11
General
- Target 2026-05-17_fdda91a46440d8f2724f0f64568cb4d1_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
- Size 22.2MB
- Sample260517-k55d1set2z
- SHA256 f35197b644c011f3c8eee56f7f7cac4d304d1f404e9659324d08a7b77073116d
Malware Config
Signatures
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 16 IoCs
- Drops startup file 4 IoCs
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 5 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-17_fdda91a46440d8f2724f0f64568cb4d1_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-17_fdda91a46440d8f2724f0f64568cb4d1_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Checks processor information in registry
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Updates\winupdate.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Updates\winupdate.exe1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\DriverUpdate.exe"C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\DriverUpdate.exe"1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
cryptor_debug.log
cryptor_debug.log
cryptor_debug.log
cryptor_debug.log
cryptor_debug.log
winupdate.exe
memory/2876-81-0x000001B48C1B0000-0x000001B48EDD5000-memory.dmp
memory/2876-86-0x000001B48C1B0000-0x000001B48EDD5000-memory.dmp
memory/2876-83-0x000001B48C1B0000-0x000001B48EDD5000-memory.dmp
memory/2876-91-0x000001B48C1B0000-0x000001B48EDD5000-memory.dmp
memory/2876-84-0x000001B48C1B0000-0x000001B48EDD5000-memory.dmp
memory/3112-27-0x00000283179B0000-0x000002831A5D5000-memory.dmp
memory/3112-26-0x00000283179B0000-0x000002831A5D5000-memory.dmp
memory/3112-24-0x00000283179B0000-0x000002831A5D5000-memory.dmp
memory/3112-25-0x00000283179B0000-0x000002831A5D5000-memory.dmp
memory/3112-102-0x00000283179B0000-0x000002831A5D5000-memory.dmp
memory/3112-101-0x00000283179B0000-0x000002831A5D5000-memory.dmp
memory/4028-75-0x0000017C1CC20000-0x0000017C1F845000-memory.dmp
memory/4028-85-0x0000017C1CC20000-0x0000017C1F845000-memory.dmp
memory/4028-97-0x0000017C1CC20000-0x0000017C1F845000-memory.dmp
memory/4028-82-0x0000017C1CC20000-0x0000017C1F845000-memory.dmp
memory/4028-80-0x0000017C1CC20000-0x0000017C1F845000-memory.dmp