397358e330da33258fa2ab075b8572cb9d0ca969295d06d7e76900b9c2f6e989

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/07/2026, 00:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_22e635e617fcfc1eabd93a3e8289e183_akira_cobalt-strike_rusty-stealer_satacom.exe
Size 454KB
Sample260701-af4fbact3t
SHA256 397358e330da33258fa2ab075b8572cb9d0ca969295d06d7e76900b9c2f6e989
MD5 22e635e617fcfc1eabd93a3e8289e183
SHA1 1154a2f06907c743a7e7585655321e7e353fdd38
SHA512 e7582624988f9897935544f5d4f605fcefca6a5b9d2e1a004dcc509c9590683dd1ab33a35d4ae7cc1475f750dc64949009ddc247ac0e0ff342af039e4889f6ee
SSDEEP 6144:D80rtpBhuCfEJ5Or0ire/X+yfpuH28hqUUrkAhhl4l1iw3yu6v0onDe3XfRtWrXV:Qszt6W4bhYloR5v0O60
TLSH
T15FA4BF25798655F9D51BC43482528E72B53670CB0B32B9FF0594923C3FAAEFA2F38614
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

persistence

Malware Config

Signatures

Detects executables manipulated with Fody 3 IoCs

resource	yara_rule
behavioral1/files/0x000800000002448e-2.dat	INDICATOR_EXE_Packed_Fody
behavioral1/memory/3524-4-0x00000291442D0000-0x000002914430A000-memory.dmp	INDICATOR_EXE_Packed_Fody
behavioral1/memory/3524-6-0x0000029144690000-0x00000291446CC000-memory.dmp	INDICATOR_EXE_Packed_Fody

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	lsass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	tmp1007852474.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	wininit.exe

Executes dropped EXE 6 IoCs

pid	Process
3524	tmp1007852474.exe
2144	wininit.exe
1584	wininit.exe
4044	lsass.exe
4580	lsass.exe
2224	lsass.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3524	tmp1007852474.exe
Token: SeDebugPrivilege	1584	wininit.exe
Token: SeDebugPrivilege	4580	lsass.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3188 wrote to memory of 3524	3188	2026-06-30_22e635e617fcfc1eabd93a3e8289e183_akira_cobalt-strike_rusty-stealer_satacom.exe	85
PID 3524 wrote to memory of 2144	3524	tmp1007852474.exe	86
PID 1584 wrote to memory of 4044	1584	wininit.exe	89
PID 4580 wrote to memory of 2224	4580	lsass.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-06-30_22e635e617fcfc1eabd93a3e8289e183_akira_cobalt-strike_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_22e635e617fcfc1eabd93a3e8289e183_akira_cobalt-strike_rusty-stealer_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3188
- C:\Users\Admin\AppData\Local\Temp\tmp1007852474.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp1007852474.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3524
- - C:\Users\Admin\AppData\Roaming\wininit.exe
    "C:\Users\Admin\AppData\Roaming\wininit.exe" /fromstartup
    3⤵
    - Executes dropped EXE
    PID:2144

C:\Users\Admin\AppData\Roaming\wininit.exe
C:\Users\Admin\AppData\Roaming\wininit.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Users\Admin\AppData\Roaming\lsass.exe
  "C:\Users\Admin\AppData\Roaming\lsass.exe" /fromstartup
  2⤵
  - Executes dropped EXE
  PID:4044

C:\Users\Admin\AppData\Roaming\lsass.exe
C:\Users\Admin\AppData\Roaming\lsass.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Users\Admin\AppData\Roaming\lsass.exe
  "C:\Users\Admin\AppData\Roaming\lsass.exe" /fromstartup
  2⤵
  - Executes dropped EXE
  PID:2224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

angel_debug.txt

Path C:\Users\Admin\AppData\Local\Temp\angel_debug.txt
Size 430B
SHA256 3865605fdafded781ecae348fab1bc57b1ac6edf3d71e4c08c018ac0a765a9b9
MD5 5a96b6717984620f58e416bd327048ac
SHA1 60f8b51325a288bd34e2662dd252c8b167f1f5ca
SHA512 a0e04197fa1849eefd2b93f94d671585b42dbdbd27fe83a95c5a55f795afdf7d9d5a0f0be300f606f482779f6fc4abeef1a6357504639797c41793668f78c3d0
TLSH
T172E065D155C341990857129600FDBACFEFEF99C5EA08A1A18769700CEDC061CAFF113E
MD5 SHA1 SHA512 TLSH

Submit Download

angel_debug.txt

Path C:\Users\Admin\AppData\Local\Temp\angel_debug.txt
Size 508B
SHA256 e24a0743c594d5500df82a6261b5bba0c5ba17a85ad1ecb13677fd7b7393b860
MD5 cbbcd8a25d99206fb7730f431cd02156
SHA1 09dab4d32213ddd05abd325cee9aeade5a2692e2
SHA512 58859b5252095a7437baab63d79da3f6ddbe958c4f674235bec60d2d0f7a2270184c7cda574bfdc994ed73a6ccfb70d433c567e6bc2e6b6d22cdb9fa906c1ebe
TLSH
T168F082D144C341D94853125A00BDBACFEFEFA9C5EA0891A08B69700CEDC061C9FF113E
MD5 SHA1 SHA512 TLSH

Submit Download

angel_debug.txt

Path C:\Users\Admin\AppData\Local\Temp\angel_debug.txt
Size 860B
SHA256 481f29552299f5d3e8bc9abb21c03d256066d7d680ce1bf62b0c47edfdc27a34
MD5 fcb3cd07efe18db82864efe4194caaf0
SHA1 a2d4f91c1e3fe597f17b49d8e0e54a846028dedd
SHA512 c514489d4196e6c390ae788367bdd443e36c0d6675480cc2e81e1e311779db913f18eb13aa92290d2f624ab3c0c0de5d721fa2a01af6d9ff6673bae70920e4cb
TLSH
T1F011659155C341990856119E10BDBACFEFEEA9C5EA0861A18769700CEDC061C9FF113A
MD5 SHA1 SHA512 TLSH

Submit Download

angel_debug.txt

Path C:\Users\Admin\AppData\Local\Temp\angel_debug.txt
Size 938B
SHA256 96842ed95f57319803b8d313d1539047f62d235d1315445e55acb10b49eb54ab
MD5 d811ca003739a8a817ba36b955822f5b
SHA1 fdb32d32c755a26f732059ba414f08fccac01a5c
SHA512 3a0fd40a6e7c2c1110f95a93493ec86ffe405f4aeba8125377a74c06523987a4b660cde0af8d97252e08bc88064dd03d53eb07c81b9a2fbcc5cb176af91ec6b4
TLSH
T1CC11C6D144C345D90852119E10BDBACFEFEEBDC5EA0861A18B69700DEDC061C9FF113A
MD5 SHA1 SHA512 TLSH

Submit Download

angel_debug.txt

Path C:\Users\Admin\AppData\Local\Temp\angel_debug.txt
Size 1KB
SHA256 f032f3b2c326f075e13c5a174bc1f29e2fc7f5e208e8a938cc691c43070bfae4
MD5 55e697dcf37f53be9248ce6af8887449
SHA1 278c07811540be83d87defa1e0472afb8103037a
SHA512 0329a5be4cffbf10b1e839cdc195ae861dfcfffae3ef1bba23fa7c93954c6d1f73299139d2dc6fcaab4f0c40b62d1616d2cd58a1441c1bf2280e5806b2f53118
TLSH
T17521A79155D345DD0856109A10BDBECFEFEEADC5EA0862A2876D700DEDC061C9FF113A
MD5 SHA1 SHA512 TLSH

Submit Download

angel_debug.txt

Path C:\Users\Admin\AppData\Local\Temp\angel_debug.txt
Size 1KB
SHA256 de9d81eb296dbb72c7b903103a586269940510d7944ae7e3e2927bd8678c94ea
MD5 003b236eeb7a7382f6027f85bda33392
SHA1 fc88821437875a56e2c836a352f63b5385d9cc31
SHA512 5c0ce1c46692f6f63896e7fc0ab5ce0b81079ce024352fce0c6a3c442541a21cbc1f753100d9606c79248215f5336cea6c1f6c22889240c379978299da06122a
TLSH
T16921069155C355D90963109A10BDBACFEFEDA9C5EA0861A2873D700DEDC061CDFF117A
MD5 SHA1 SHA512 TLSH

Submit Download

angel_debug.txt

Path C:\Users\Admin\AppData\Local\Temp\angel_debug.txt
Size 1KB
SHA256 691a221297b71ecf883f06121ca86c431b0954e14480835cea216e98d3773e8f
MD5 788a2be8517c730d0250ffc702a13462
SHA1 58d8b3f3a067d7105f716373a83b887f03319d5a
SHA512 235e000ba426c03db5fd5cd63e5a885fe40dd8155214b5055282b0199f287446cfbed2b47e290cdcfcfaa23ded9eb2e8b493c6bcc02ef59c0a587aacdc403a81
TLSH
T1DD3134A155C355D90963109A10BDBACFEFADA9C5EA08A1A2873D700DEDC061CDFF117A
MD5 SHA1 SHA512 TLSH

Submit Download

angel_debug.txt

Path C:\Users\Admin\AppData\Local\Temp\angel_debug.txt
Size 1KB
SHA256 71d07b20b02f67424e0521d730cb3b45f58a18caf53a7df6f64359b1e5cd7054
MD5 e585c813d5005f2e8d7c5803f77c7daf
SHA1 ab2ea6f7c72c9f0ffd4f9e42735bac48fa25b5d5
SHA512 5ce052c0d88fed15e1ef504ce41ef27b9a2d99fd868cf7ab61339c17736ecd748169d0d3a90695b6de5b0df11d4fd95af257b7e0a3a31d5bacc6eb22f24f65b2
TLSH
T1EC3146A155C364E90963109A10BDBACFEFBDA9C5AA0861A2473C700DEED065CDFF117A
MD5 SHA1 SHA512 TLSH

Submit Download

angel_debug.txt

Path C:\Users\Admin\AppData\Local\Temp\angel_debug.txt
Size 1KB
SHA256 b9db8055aaafb7de4465a8fa29cbc0a1359fb731e5213a9c11483409b4f6b2db
MD5 d95fc402980dfd390cce8f50ad8cb3f0
SHA1 f8843c813f6f2110540d0049f64ecac8714a10f1
SHA512 3da062cf38c7b306277035d820f5c8a472922f6b273ddfadd9fa4202ce17a6cf5757516e351b0a73501e48282a1258d1ac82dc838b77b99caae318791bdbb37b
TLSH
T1A83149A151C364E90963105A10BDBACFEFBDA9C5AA0861A2473C7009FED065CDFF117A
MD5 SHA1 SHA512 TLSH

Submit Download

angel_debug.txt

Path C:\Users\Admin\AppData\Local\Temp\angel_debug.txt
Size 1KB
SHA256 d3247127cb4ac1c509c2278d8b6f141a99da920f63659061169d2423e26f12e7
MD5 073977bda39cc4ba2f996f679e6cc0d6
SHA1 d6c753e63411d545cabdc50b99013058e40e6e51
SHA512 e7139dd6e5a705c6f7aadcdaeca425bf20988ee1ad05eacd9437fc5b6fffea06455e0faf2cecc0f0eb178205c74fb033c65eeee07bf7920e2d2f6420cb2229db
TLSH
T1EA416BA151C360E90A53105A10BDBACFDFBD99D5AA0860A3473C6009FEE065CDFF11BA
MD5 SHA1 SHA512 TLSH

Submit Download

angel_debug.txt

Path C:\Users\Admin\AppData\Local\Temp\angel_debug.txt
Size 2KB
SHA256 0c2796edb210dbad91684778449fcd818318de37e86d3af2e517922cbd9a3f41
MD5 6e5268b1b2cfd01b646dfa161b73c0ec
SHA1 57e5f8f84ac388d2b143f55fe33e0b60a784e60e
SHA512 c25e5bf61aba656ee876c3636fbf02f4cce6efe986f51858a0cfae6571a6a7f733a2be8d17ebb405213d7f2b9c0ad6c1b7fa1d9a457a1905b78c330214bd0b21
TLSH
T1AD414BA252C370E90A53106611BDB6CEDF7D95D5AA0860A3473C600AFEE165CDFF11BA
MD5 SHA1 SHA512 TLSH

Submit Download

angel_debug.txt

Path C:\Users\Admin\AppData\Local\Temp\angel_debug.txt
Size 2KB
SHA256 f1e301540d220693ba9f297caf9accc7fbe906ac8a73f1e27324912a54002df1
MD5 aef91e249d04f93234025a51be629ec5
SHA1 542f5ee8d170fb8266cd5953aad64575c47ef941
SHA512 b505bbbdedce6f57e4704bec4199a99fd6786047eb4d3704e689f121005db69c3ab2591943ee349bf48a5239728837579f32fd983aa185e3f027a33f17b43c39
TLSH
T118415BA2528370E90A63106511BEF6CEDF7D95D5AA0860A3433C600AFEE175CDFF11BA
MD5 SHA1 SHA512 TLSH

Submit Download

angel_debug.txt

Path C:\Users\Admin\AppData\Local\Temp\angel_debug.txt
Size 2KB
SHA256 2f275acd07be485453679692e827240b626ba2eb41a84a26811a8ddef3ae4db1
MD5 2954926a2eafa859709323755a49141a
SHA1 978dc31f3babe8c3c1ca2c516303e4bc1fa5f8eb
SHA512 578c48b216101d19a04604adfcf9ec8085a899232f09e2191a1c473e31569cdbfc0828f425830456bd5e898c39cecb4d5ab9eadbe52153b9e902e32a76a7fc48
TLSH
T183416C62528370E90A53106521BEF6CEDB7C55D1AA0860A3433C600AFEE175CDFF11BA
MD5 SHA1 SHA512 TLSH

Submit Download

angel_debug.txt

Path C:\Users\Admin\AppData\Local\Temp\angel_debug.txt
Size 2KB
SHA256 0ab5dac08cb47d475df0ec64be787f1cd810cda351c6629aec2e78bfea44bd77
MD5 3b611eaf6afef2f1da10fe242fed8c47
SHA1 ab7347e2e51878592b74869e0e2ccf8fbed9a61d
SHA512 9b28e128c606e09ef8e8d7ef2f756226032b6e945d474bdcfc476040f62839990f33570a72b52845bf7bd1605107e50822f7a3faceec408487d96e2ded8760a7
TLSH
T118416C62628371E916531065216EF6CEDB7C55D1AA0860A3433C600AFEF179CDFF11BA
MD5 SHA1 SHA512 TLSH

Submit Download

tmp1007852474.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp1007852474.exe
Size 217KB
SHA256 762f9ebb74d4dcc658535ea1e492ca2139bf22920fd484508d3f63dc501784c7
MD5 67405c83cee84bd782a5d302a564f302
SHA1 6e020028cd86ae5afd1fd4ff572eeaeaad0ad460
SHA512 fb4e8a329582bd2cf95374184b68c364aaf807798c33db52e07aad007583d05faeabe65add698efbae1fd5ff9f664c96a33e987e92d96eaa8cdd9e6b7744c256
SSDEEP 3072:LOoYJl3DqWhd13FC/mTXpUXJYYcXgyalbjSt2zTJhoAqtEg6xAEtan1dOxf4dxr2:LOoYrrOMrijLeAjg6xAE+1sxfSmI
TLSH
T1D624126437D10E84DDD6AAB1183FBC789198EAC044D4B3D63BCC65239D3B781E662BC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2144-80-0x0000027DA1310000-0x0000027DA1320000-memory.dmp

Download

memory/2144-32-0x0000027DA1310000-0x0000027DA1320000-memory.dmp

Download

memory/3524-4-0x00000291442D0000-0x000002914430A000-memory.dmp

Download

memory/3524-5-0x000002915E940000-0x000002915E950000-memory.dmp

Download

memory/3524-6-0x0000029144690000-0x00000291446CC000-memory.dmp

Download

memory/3524-12-0x0000029146030000-0x0000029146088000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads