f16c1e55f922281ec0a242cacd315b31d9600c5f681b650540bf6c040fdfcf75

General

Target
2026-07-08_8a3a44067277d4ad09a6d4b5b9123f16_akira_cobalt-strike_rusty-stealer_satacom.exe
Size 322KB
Sample260708-e16hmaay2w
SHA256 f16c1e55f922281ec0a242cacd315b31d9600c5f681b650540bf6c040fdfcf75
MD5 8a3a44067277d4ad09a6d4b5b9123f16
SHA1 3c10dc082abd3c664eaffa3f3486b9e2a68c8dc5
SHA512 ecc090bd564426ea19cae123cbc9c9f91c8695314b63d992b4bcd335292e7efdc0fb8d0bc4a2f6d42530f8efa785097a1c5dc1555e22843afb688c46a448e386
SSDEEP 6144:6jyJNre2JHcmszwWkkN97MJhIw07LbK64zysxvDDcH:6jQre2JHU8heXOxvH
TLSH
T192643B15AA5A5CBCD586C874C34A8EA3692174CB0B36E8FF05C515343F6EAF96F38318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	2026-07-08_8a3a44067277d4ad09a6d4b5b9123f16_akira_cobalt-strike_rusty-stealer_satacom.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	lsass.exe

Executes dropped EXE 5 IoCs

pid	Process
4884	lsass.exe
4856	lsass.exe
3240	lsass.exe
2448	lsass.exe
1896	lsass.exe

Checks system information in the registry 2 TTPs 6 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-07-08_8a3a44067277d4ad09a6d4b5b9123f16_akira_cobalt-strike_rusty-stealer_satacom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	lsass.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	lsass.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	lsass.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	lsass.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	lsass.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	2026-07-08_8a3a44067277d4ad09a6d4b5b9123f16_akira_cobalt-strike_rusty-stealer_satacom.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	lsass.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1536	schtasks.exe
1160	schtasks.exe
3360	schtasks.exe
2372	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4156	2026-07-08_8a3a44067277d4ad09a6d4b5b9123f16_akira_cobalt-strike_rusty-stealer_satacom.exe
4156	2026-07-08_8a3a44067277d4ad09a6d4b5b9123f16_akira_cobalt-strike_rusty-stealer_satacom.exe
4884	lsass.exe
4884	lsass.exe
4856	lsass.exe
4856	lsass.exe
3240	lsass.exe
3240	lsass.exe
2448	lsass.exe
2448	lsass.exe
1896	lsass.exe
1896	lsass.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4156 wrote to memory of 3360	4156	2026-07-08_8a3a44067277d4ad09a6d4b5b9123f16_akira_cobalt-strike_rusty-stealer_satacom.exe	84
PID 4156 wrote to memory of 2372	4156	2026-07-08_8a3a44067277d4ad09a6d4b5b9123f16_akira_cobalt-strike_rusty-stealer_satacom.exe	86
PID 4156 wrote to memory of 4884	4156	2026-07-08_8a3a44067277d4ad09a6d4b5b9123f16_akira_cobalt-strike_rusty-stealer_satacom.exe	88
PID 4856 wrote to memory of 1536	4856	lsass.exe	91
PID 4856 wrote to memory of 1160	4856	lsass.exe	93
PID 4856 wrote to memory of 3240	4856	lsass.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-08_8a3a44067277d4ad09a6d4b5b9123f16_akira_cobalt-strike_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_8a3a44067277d4ad09a6d4b5b9123f16_akira_cobalt-strike_rusty-stealer_satacom.exe"
1⤵
- Checks computer location settings
- Checks system information in the registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4156
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "WindowsUpdate" /tr "\"C:\Users\Admin\AppData\Roaming\lsass.exe\" /fromstartup" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3360
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "WindowsUpdateWatchdog" /tr "\"C:\Users\Admin\AppData\Roaming\lsass.exe\" /watchdog" /sc minute /mo 1 /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2372
- C:\Users\Admin\AppData\Roaming\lsass.exe
  "C:\Users\Admin\AppData\Roaming\lsass.exe" /fromstartup
  2⤵
  - Executes dropped EXE
  - Checks system information in the registry
  - Suspicious behavior: EnumeratesProcesses
  PID:4884

C:\Users\Admin\AppData\Roaming\lsass.exe
"C:\Users\Admin\AppData\Roaming\lsass.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Checks system information in the registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "WindowsUpdate" /tr "\"C:\Users\Admin\AppData\Roaming\lsass.exe\" /fromstartup" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1536
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "WindowsUpdateWatchdog" /tr "\"C:\Users\Admin\AppData\Roaming\lsass.exe\" /watchdog" /sc minute /mo 1 /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1160
- C:\Users\Admin\AppData\Roaming\lsass.exe
  "C:\Users\Admin\AppData\Roaming\lsass.exe" /fromstartup
  2⤵
  - Executes dropped EXE
  - Checks system information in the registry
  - Suspicious behavior: EnumeratesProcesses
  PID:3240

C:\Users\Admin\AppData\Roaming\lsass.exe
C:\Users\Admin\AppData\Roaming\lsass.exe /watchdog
1⤵
- Executes dropped EXE
- Checks system information in the registry
- Suspicious behavior: EnumeratesProcesses
PID:2448

C:\Users\Admin\AppData\Roaming\lsass.exe
C:\Users\Admin\AppData\Roaming\lsass.exe /watchdog
1⤵
- Executes dropped EXE
- Checks system information in the registry
- Suspicious behavior: EnumeratesProcesses
PID:1896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Users\Admin\AppData\Roaming\lsass.exe
Size 322KB
SHA256 f16c1e55f922281ec0a242cacd315b31d9600c5f681b650540bf6c040fdfcf75
MD5 8a3a44067277d4ad09a6d4b5b9123f16
SHA1 3c10dc082abd3c664eaffa3f3486b9e2a68c8dc5
SHA512 ecc090bd564426ea19cae123cbc9c9f91c8695314b63d992b4bcd335292e7efdc0fb8d0bc4a2f6d42530f8efa785097a1c5dc1555e22843afb688c46a448e386
SSDEEP 6144:6jyJNre2JHcmszwWkkN97MJhIw07LbK64zysxvDDcH:6jQre2JHU8heXOxvH
TLSH
T192643B15AA5A5CBCD586C874C34A8EA3692174CB0B36E8FF05C515343F6EAF96F38318
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads