e1c01e0d170445a1ab1051c8531a675eff3a9a57db7529d190a01e043dcb3724

Analysis

max time kernel
150s
max time network
121s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 04:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_286546739e6df7bdc10ca44cb3437141_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Size 17.3MB
Sample260707-fdt2rah131
SHA256 e1c01e0d170445a1ab1051c8531a675eff3a9a57db7529d190a01e043dcb3724
MD5 286546739e6df7bdc10ca44cb3437141
SHA1 4b39117bb739e990bc0d18de88896067170548ce
SHA512 59cdb97d5a3a38710db2be5f5fb19418caba6faa59a02c640bc811a1086f5bc3f5b8dacd974f33df95f5aa9b388f28e4a5f0a1dbce9cee21ab09819d90dee7d3
SSDEEP 98304:qmvucxrjfEtUh1peWkagUqRIUqI5wZNRm+yfj5W1cHo1O:qyDxrx1SGUfwZyhfj57
TLSH
T14B070A26F9494D65D199C434829A4753063070CB1E14BDBF36CC892C2F9FFBE6A3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1532	powershell.exe
4736	powershell.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3728	2026-07-06_286546739e6df7bdc10ca44cb3437141_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3728	2026-07-06_286546739e6df7bdc10ca44cb3437141_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3728	2026-07-06_286546739e6df7bdc10ca44cb3437141_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3728	2026-07-06_286546739e6df7bdc10ca44cb3437141_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3728	2026-07-06_286546739e6df7bdc10ca44cb3437141_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3728	2026-07-06_286546739e6df7bdc10ca44cb3437141_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3728	2026-07-06_286546739e6df7bdc10ca44cb3437141_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3728	2026-07-06_286546739e6df7bdc10ca44cb3437141_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
1532	powershell.exe
1532	powershell.exe
1384	2026-07-06_286546739e6df7bdc10ca44cb3437141_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
1384	2026-07-06_286546739e6df7bdc10ca44cb3437141_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
1384	2026-07-06_286546739e6df7bdc10ca44cb3437141_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
1384	2026-07-06_286546739e6df7bdc10ca44cb3437141_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
1384	2026-07-06_286546739e6df7bdc10ca44cb3437141_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
1384	2026-07-06_286546739e6df7bdc10ca44cb3437141_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
1384	2026-07-06_286546739e6df7bdc10ca44cb3437141_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
1384	2026-07-06_286546739e6df7bdc10ca44cb3437141_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4736	powershell.exe
4736	powershell.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	1532	powershell.exe
Token: SeIncreaseQuotaPrivilege	1532	powershell.exe
Token: SeSecurityPrivilege	1532	powershell.exe
Token: SeTakeOwnershipPrivilege	1532	powershell.exe
Token: SeLoadDriverPrivilege	1532	powershell.exe
Token: SeSystemProfilePrivilege	1532	powershell.exe
Token: SeSystemtimePrivilege	1532	powershell.exe
Token: SeProfSingleProcessPrivilege	1532	powershell.exe
Token: SeIncBasePriorityPrivilege	1532	powershell.exe
Token: SeCreatePagefilePrivilege	1532	powershell.exe
Token: SeBackupPrivilege	1532	powershell.exe
Token: SeRestorePrivilege	1532	powershell.exe
Token: SeShutdownPrivilege	1532	powershell.exe
Token: SeDebugPrivilege	1532	powershell.exe
Token: SeSystemEnvironmentPrivilege	1532	powershell.exe
Token: SeRemoteShutdownPrivilege	1532	powershell.exe
Token: SeUndockPrivilege	1532	powershell.exe
Token: SeManageVolumePrivilege	1532	powershell.exe
Token: 33	1532	powershell.exe
Token: 34	1532	powershell.exe
Token: 35	1532	powershell.exe
Token: 36	1532	powershell.exe
Token: SeDebugPrivilege	4736	powershell.exe
Token: SeIncreaseQuotaPrivilege	4736	powershell.exe
Token: SeSecurityPrivilege	4736	powershell.exe
Token: SeTakeOwnershipPrivilege	4736	powershell.exe
Token: SeLoadDriverPrivilege	4736	powershell.exe
Token: SeSystemProfilePrivilege	4736	powershell.exe
Token: SeSystemtimePrivilege	4736	powershell.exe
Token: SeProfSingleProcessPrivilege	4736	powershell.exe
Token: SeIncBasePriorityPrivilege	4736	powershell.exe
Token: SeCreatePagefilePrivilege	4736	powershell.exe
Token: SeBackupPrivilege	4736	powershell.exe
Token: SeRestorePrivilege	4736	powershell.exe
Token: SeShutdownPrivilege	4736	powershell.exe
Token: SeDebugPrivilege	4736	powershell.exe
Token: SeSystemEnvironmentPrivilege	4736	powershell.exe
Token: SeRemoteShutdownPrivilege	4736	powershell.exe
Token: SeUndockPrivilege	4736	powershell.exe
Token: SeManageVolumePrivilege	4736	powershell.exe
Token: 33	4736	powershell.exe
Token: 34	4736	powershell.exe
Token: 35	4736	powershell.exe
Token: 36	4736	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 3728	1384	2026-07-06_286546739e6df7bdc10ca44cb3437141_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	88
PID 3728 wrote to memory of 1532	3728	2026-07-06_286546739e6df7bdc10ca44cb3437141_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	89
PID 1384 wrote to memory of 4736	1384	2026-07-06_286546739e6df7bdc10ca44cb3437141_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	91
PID 1384 wrote to memory of 756	1384	2026-07-06_286546739e6df7bdc10ca44cb3437141_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-07-06_286546739e6df7bdc10ca44cb3437141_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_286546739e6df7bdc10ca44cb3437141_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Users\Admin\AppData\Local\Temp\2026-07-06_286546739e6df7bdc10ca44cb3437141_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-06_286546739e6df7bdc10ca44cb3437141_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe" --no-dashboard serve --host 127.0.0.1 --port 8787
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3728
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -NoProfile -Command "Get-CimInstance Win32_VideoController | Select-Object Name,AdapterRAM | ForEach-Object { $_.Name + '|' + $_.AdapterRAM }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "Get-CimInstance Win32_VideoController | Select-Object Name,AdapterRAM | ForEach-Object { $_.Name + '|' + $_.AdapterRAM }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4736
- C:\Windows\system32\curl.exe
  "curl" -sf --max-time 2 http://localhost:8080/health
  2⤵
  PID:756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2706f7a3cde18304b8eb65dc0fa6d884f09a46a78e320302afda951d20885534
MD5 dc6571b4e39d13392bb7f996d9a95ef5
SHA1 a1838cd4f6a2a1ff743489171ba9f83c662362c7
SHA512 5e2582268c12399a5b29751932d896eb47931478bbafa197faf15d26470a589e1892887a85e7061e431ad8163259ee00682e34c167e9ca204ffd33c888a35f63
TLSH
T199219833F3DC8214CC99003A10DDAC1036B6C7CB40DECF9B6B85E159A82F298DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_zcokh5nf.nqi.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zcokh5nf.nqi.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1532-10-0x00000256F2460000-0x00000256F247E000-memory.dmp

Download

memory/1532-14-0x00000256F2540000-0x00000256F254A000-memory.dmp

Download

memory/1532-7-0x00007FFD0AA00000-0x00007FFD0B3A4000-memory.dmp

Download

memory/1532-12-0x00000256F2480000-0x00000256F2532000-memory.dmp

Download

memory/1532-13-0x00007FFD0AA00000-0x00007FFD0B3A4000-memory.dmp

Download

memory/1532-11-0x00007FFD0AA00000-0x00007FFD0B3A4000-memory.dmp

Download

memory/1532-1-0x00007FFD0AB8F000-0x00007FFD0AB90000-memory.dmp

Download

memory/1532-6-0x00007FFD0AA00000-0x00007FFD0B3A4000-memory.dmp

Download

memory/1532-16-0x00000256F28E0000-0x00000256F2904000-memory.dmp

Download

memory/1532-15-0x00000256F28E0000-0x00000256F290A000-memory.dmp

Download

memory/1532-18-0x00007FFD0AA00000-0x00007FFD0B3A4000-memory.dmp

Download

memory/1532-19-0x00007FFD0AA00000-0x00007FFD0B3A4000-memory.dmp

Download

memory/1532-5-0x00000256F23C0000-0x00000256F23E2000-memory.dmp

Download

memory/1532-2-0x00007FFD0AA00000-0x00007FFD0B3A4000-memory.dmp

Download