a80c8c74fdf6449fbc2e7407f2319965960ecb6607df7db669e061fae454f978

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/07/2026, 16:08

Target
2026-07-07_690114df402bcf4a77c087668d014fa2_akira_cobalt-strike_rusty-stealer_satacom.exe
Size 734KB
Sample260707-tlkpyahs91
SHA256 a80c8c74fdf6449fbc2e7407f2319965960ecb6607df7db669e061fae454f978
MD5 690114df402bcf4a77c087668d014fa2
SHA1 ce5dfdaaeff911c3b1cab42a5e1b9e35b2555160
SHA512 29d7c355b03a57f7a22922805168e18779340ec6189b565d47b25bbd20be05a2a2aeaa825bbb8b0faa372994580e6d88283c7a2bd9762125ad5c4e58a86e94c2
SSDEEP 6144:uhbyLql0I8OWPsWwa0tFAp5nZ4ssqT2V04ICrNIEctElbeaO6M2hL5Ss:uheWlb8VPuBkntrO
TLSH
T1F0F4F9267A7951D9C1BBC03992579F22B921749E4B397BF705D0823A2F24EF86E3C314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4168 wrote to memory of 5116	4168	2026-07-07_690114df402bcf4a77c087668d014fa2_akira_cobalt-strike_rusty-stealer_satacom.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-07_690114df402bcf4a77c087668d014fa2_akira_cobalt-strike_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-07_690114df402bcf4a77c087668d014fa2_akira_cobalt-strike_rusty-stealer_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Windows\system32\curl.exe
  "curl" -fsSL https://api.github.com/repos/bab2min/Kiwi/releases/latest
  2⤵
  PID:5116