Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
01/07/2026, 00:53
General
- Target 2026-06-30_0a413fa7ca09bc3d030e47a5eef54cfa_akira_cobalt-strike_rusty-stealer_satacom.exe
- Size 620KB
- Sample260701-a855lsbx6k
- SHA256 de2aaaee098e902a77238092a16d473dd1f38999efb74eaf4d6d3756b3e2dedb
Malware Config
Signatures
- Detects executables manipulated with Fody 3 IoCs
- Executes dropped EXE 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_0a413fa7ca09bc3d030e47a5eef54cfa_akira_cobalt-strike_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-30_0a413fa7ca09bc3d030e47a5eef54cfa_akira_cobalt-strike_rusty-stealer_satacom.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3072532445.exe"C:\Users\Admin\AppData\Local\Temp\3072532445.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\lsass.exe"C:\Users\Admin\AppData\Roaming\lsass.exe" /fromstartup3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\lsass.exeC:\Users\Admin\AppData\Roaming\lsass.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\lsass.exe"C:\Users\Admin\AppData\Roaming\lsass.exe" /fromstartup2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
3072532445.exe
a.txt
a.txt
a.txt
a.txt
a.txt
a.txt
a.txt
a.txt
a.txt
a.txt
a.txt
a.txt
a.txt
a.txt
a.txt
a.txt
a.txt
a.txt
a.txt
a.txt
a.txt
a.txt
a.txt
a.txt
a.txt
a.txt
memory/3688-9-0x00007FF908040000-0x00007FF9089E4000-memory.dmp
memory/3688-19-0x00007FF908040000-0x00007FF9089E4000-memory.dmp
memory/3688-13-0x00007FF908040000-0x00007FF9089E4000-memory.dmp
memory/3688-12-0x00007FF908040000-0x00007FF9089E4000-memory.dmp
memory/3688-10-0x00007FF908040000-0x00007FF9089E4000-memory.dmp
memory/3688-14-0x00007FF908040000-0x00007FF9089E4000-memory.dmp
memory/3688-8-0x0000014C70940000-0x0000014C70998000-memory.dmp
memory/3688-6-0x0000014C6F000000-0x0000014C6F03C000-memory.dmp
memory/3688-5-0x0000014C6EAC0000-0x0000014C6EB36000-memory.dmp
memory/3688-4-0x00007FF9081CF000-0x00007FF9081D0000-memory.dmp
memory/3688-18-0x00007FF908040000-0x00007FF9089E4000-memory.dmp
memory/5912-26-0x00007FF908040000-0x00007FF9089E4000-memory.dmp
memory/5912-48-0x00007FF908040000-0x00007FF9089E4000-memory.dmp
memory/5912-47-0x00007FF908040000-0x00007FF9089E4000-memory.dmp
memory/5912-20-0x00007FF908040000-0x00007FF9089E4000-memory.dmp
memory/5912-24-0x00007FF908040000-0x00007FF9089E4000-memory.dmp
memory/5912-25-0x00007FF908040000-0x00007FF9089E4000-memory.dmp
memory/5912-30-0x00007FF908040000-0x00007FF9089E4000-memory.dmp
memory/5912-29-0x00007FF908040000-0x00007FF9089E4000-memory.dmp
memory/5912-28-0x00007FF908040000-0x00007FF9089E4000-memory.dmp
memory/5912-27-0x00007FF908040000-0x00007FF9089E4000-memory.dmp