23c714e2d37ae2113bcdec055caaf9e17587ad03e64acd0f10fa221c68ef3a8f

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/07/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_71125a65a31f856e6b75ca256977e2f6_akira_cobalt-strike_rusty-stealer_satacom.exe
Size 9.9MB
Sample260708-e5t1dsbw3p
SHA256 23c714e2d37ae2113bcdec055caaf9e17587ad03e64acd0f10fa221c68ef3a8f
MD5 71125a65a31f856e6b75ca256977e2f6
SHA1 191f71b35dcf8b6b20c1b4cd55ec285cd06f4302
SHA512 a00f716340ca6e05b3316f66de91b0d9ddf1bac5d5ec7859e28d66327c0a0a0c7aecd2861dcc5e2a87ae86e2edd9df6817663718292f6fbab43557b143578ce5
SSDEEP 196608:M0YuZOcI2NmjG5K6r4/qszLrq6FPrkX7rYg1NPpFZKfFp4xWi+kXtLR:T1ZQ2YjQVsznt1rkXvY4B+SsXWv
TLSH
T125A63347F154A3F1D04EC9FD525B97227AF77C0C4721F68A8BD6AF3A1D907A01A0A31A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4408	java.exe

Loads dropped DLL 11 IoCs

pid	Process
4408	java.exe
4408	java.exe
4408	java.exe
4408	java.exe
4408	java.exe
4408	java.exe
4408	java.exe
4408	java.exe
4408	java.exe
4408	java.exe
4408	java.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	java.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	java.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 4408	4552	2026-07-08_71125a65a31f856e6b75ca256977e2f6_akira_cobalt-strike_rusty-stealer_satacom.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-07-08_71125a65a31f856e6b75ca256977e2f6_akira_cobalt-strike_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_71125a65a31f856e6b75ca256977e2f6_akira_cobalt-strike_rusty-stealer_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Users\Admin\AppData\Local\Synostub\Hello\1a46756690f961e3\runtime\bin\java.exe
  "C:\Users\Admin\AppData\Local\Synostub\Hello\1a46756690f961e3\runtime\bin/java.exe" -jar C:\Users\Admin\AppData\Local\Synostub\Hello\1a46756690f961e3\app\Hello.jar
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  PID:4408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Hello.jar

Path C:\Users\Admin\AppData\Local\Synostub\Hello\1a46756690f961e3\app\Hello.jar
Size 1KB
SHA256 9a2f1857c8b0ca20bddfde3f6b73f7a328d73af70b1567df9f33cf7cf5723bb7
MD5 15c1a2f24dcab5c4e6e37d57d1be211e
SHA1 e256df70dc0d58a3eb2ae4390c2e63df2f71ce01
SHA512 b57544362abe589da58a04dbbbfcad496bc0952b660fdc66e422494d7f6aacd5714433814c6a1c018e5ebb0b29fd1f417cd4f00cf85186a32035807f2f1810de
TLSH
T15921662838E5D806F67F52B013636D167B8915025B0DCF6B116068845D3C954F716F97
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Synostub\Hello\1a46756690f961e3\runtime\bin\VCRUNTIME140.dll
Size 117KB
SHA256 02c6aa0e6e624411a9f19b0360a7865ab15908e26024510e5c38a9c08362c35a
MD5 caf9edded91c1f6c0022b278c16679aa
SHA1 4812da5eb86a93fb0adc5bb60a4980ee8b0ad33a
SHA512 32ac84642a9656609c45a6b649b222829be572b5fdeb6d5d93acea203e02816cf6c06063334470e8106871bdc9f2f3c7f0d1d3e554da1832ba1490f644e18362
SSDEEP 1536:dI2v39UXigCBs29DdxfggO6vMMKZsY2ofRjoecbdhUwdJTzmZhTzC:diwskD8B6vMMEs5oGecbd2wHT0Te
TLSH
T1FBC38C4672A042FBD16AC274C1E35E17FB75B84487A0A7CF03A58A690F53BE09E3D385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.dll

Path C:\Users\Admin\AppData\Local\Synostub\Hello\1a46756690f961e3\runtime\bin\java.dll
Size 119KB
SHA256 f030ef889dad43f583def1c434571867de353eb9507332de4d9cc2623fcd101d
MD5 828f1ad22086e3d09870eb929b0b4006
SHA1 540e726cdfe5ce7c5141611d6e21d037aa5caead
SHA512 60620d999ec0adb86393cb69762c6a224fb09d1c49d774094bd72a9a4db318c6a1fe534587800f3ff41ab41391cd8dfd692f39834167d8b00d997413bfce47e7
SSDEEP 3072:lRppSfRR+8bYgRYw+uLfMwyNG3cUfrRdG6m+v:FpSpR+8bYC+uo2dGK
TLSH
T13EC34B5BA3654097F87BF1BC802A864BD372B4B11141E30E43A5CA6E9F8FB713D1A791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Users\Admin\AppData\Local\Synostub\Hello\1a46756690f961e3\runtime\bin\java.exe
Size 49KB
SHA256 5f6248f9c0f32b38ffaba813819bf3331536a48c7ddc45b18e73acd15a6cf7ef
MD5 6d654ed36571cd22ebb9360d5b1451b8
SHA1 5c86668020c16fc7b5bfce07066dd8dde54ad627
SHA512 a4305cd1c7a1ac57c3abafcae247ffab809076574d9e776c704f0fa18611eade40fc00d4a12016304aa1147dc8f820ffdeec2e62b49120b4be0f41a2e889431c
SSDEEP 768:8NpWFZM5R2TyJ5R3s8D/bkt5Ruz3Vb39t5yYiDLk5kIvA:u0M5RdJ5R3sozkt5RA39t5y7VIv
TLSH
T155337C47AA183C81F42F84F158A6352751B4BD032BD173EBBDC6B21E0971391A9176EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jimage.dll

Path C:\Users\Admin\AppData\Local\Synostub\Hello\1a46756690f961e3\runtime\bin\jimage.dll
Size 33KB
SHA256 958192bdcee9b793b2444ae9ab93f1ca77b6bcaee30f7a4f8f948fb24f9cecfa
MD5 425a96acc89e26ec18cfffe4b257d888
SHA1 71453f5507516fb98419b5f4986508c2aa43b760
SHA512 2969a5a48c0fcb12644bd11fafe22f4a6b10992f3f93b210442b7166ee8ec785c565c6e9d4226e27289a862ef341128c81d584fb084ad35fa12436ef0735a01c
SSDEEP 768:VvxVtDqz+Vf2U99XdAIvhG28YiDLk5kIvh3:VXQQ9t/5G287VIvh3
TLSH
T11BF27C56EB841C85E92BD538C4AB9A2FE6F6F9521F51C3CB2720825E0F333807E58752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jli.dll

Path C:\Users\Admin\AppData\Local\Synostub\Hello\1a46756690f961e3\runtime\bin\jli.dll
Size 87KB
SHA256 750d51aa711739d0b15eb608608120a2cd0612bcc91af4ecd5d68315bb029f82
MD5 30f43cb18c69f479d10d4bf2b62ecd77
SHA1 0520c0aa463277af31129de967cbbaf2a5da1705
SHA512 74ed7b45781e10ccfeba3f7a8058aab2a9a512e22b0741caa114a576405a863b7f35cf55ae4f19c4dd681cb95a965f2860920a857d0f91b936dad2b150939a22
SSDEEP 1536:HSJp5FI5EwV3HsEpdWLRBXqP52475IOVT4TtG2OXz7VIv:HAp5FcRVcwCBXqPA8VT4Tgjz+v
TLSH
T1BD937D5753A021E0DEB7D1B9D9B5560BC3F2F0462B21938F136885AA0F637623E1CBD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Synostub\Hello\1a46756690f961e3\runtime\bin\msvcp140.dll
Size 561KB
SHA256 a4c2229bdc2a2a630acdc095b4d86008e5c3e3bc7773174354f3da4f5beb9cde
MD5 72f3d84384e888bf0d38852eb863026b
SHA1 8e6a0257591eb913ae7d0e975c56306b3f680b3f
SHA512 6d53634bc51bd383358e0d55988d70aee6ed3897bc6ae5e0d2413bed27ecff4c8092020682cd089859023b02d9a1858ac42e64d59c38ba90fbaf89b656c539a6
SSDEEP 12288:rSTTigI46Bb3SUPvRgrKtzL4oaQEKZm+jWodEEVPLwtQB:rUStZaQEKZm+jWodEE9CQB
TLSH
T1B9C41A23B74905A0E195E3B8A1878316D7F1BC4A8312A3C792FBD66D2F673D1673B250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net.dll

Path C:\Users\Admin\AppData\Local\Synostub\Hello\1a46756690f961e3\runtime\bin\net.dll
Size 58KB
SHA256 26ac128da4611938741ba57ad51329654303e3066769006c2ff7cb8603013f39
MD5 c98b3c35fc572d8446f196c6717f5b2b
SHA1 69542bcf19c96af12248cd0d9ac73fe28117fa2e
SHA512 8f753ba1d911acf81e54eca90f1eaaf1073b8ae6ff2058841a259a38f9450e44d5dd5c57ca2823c4dbe056a4d1bdeb431dcc9d2ea307b448869f4f8cd3161865
SSDEEP 1536:/rBn2zLBxyvTtPnhv5awOYwT2elIUmXXRv7VIvMiX:lnUevxl5arpflIUmHRv+vMe
TLSH
T12E436C0597D454C4E86BC67886A75E16DBB2B470325083DF1379C56EAFE73B23B25380
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nio.dll

Path C:\Users\Admin\AppData\Local\Synostub\Hello\1a46756690f961e3\runtime\bin\nio.dll
Size 78KB
SHA256 36cb33e5effa7290e846059d7aadf782ba6a8f23cc6b7e35c6204240a361b081
MD5 534f23a832a5b1e13b3a11df20ea81a4
SHA1 1731462c28bcaab629baa44bd00f0885a0d2a562
SHA512 f27b654c054ba0bfae6f69df9e1bb5c38fc2679ea9c9233c0886111e917a1a1d2f1a3b95649c9054802325a96fd1046c63044681532436db0e9790607f9c2b00
SSDEEP 1536:5uKDrKVqEiWtCnNXHlJ4Ozuwcm7n4Rxpiys6na7VIv:5uKDuVqaMN3lJhX/4Rxpi16a+v
TLSH
T18A733AA24364889BE86AB538425A574BE333FC114510A35F5368CB659F1F2B33E3E783
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.dll

Path C:\Users\Admin\AppData\Local\Synostub\Hello\1a46756690f961e3\runtime\bin\server\jvm.dll
Size 13.3MB
SHA256 5ae80bddba5165c67ee075212f858a3955fd04fa9dd629b5303ad054a8aab74a
MD5 d9bef2897f7e2696bd112da01f294221
SHA1 f4ee29861d1d2f6e601f6c59ff1d5974c21fc2d0
SHA512 5e69d7051da33c53721592b284c714eefa032ee628c1d1f1ea73992b669585cc83b0e0e952d5dfd2c842fe6d17adf1412e83f7e1287e3f7fc5c034c54d864b86
SSDEEP 393216:28ZQvTodlo6Zamz4lEx7gzX+5+eknsVnUHX9Gkd9uazninb3oeOWW1fNA1GvQHTz:j
TLSH
T152E66C17677840D1D02BD1B98AA79A0FD7F2B8948731A7CB11A016AD6F23FE1593F360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\Synostub\Hello\1a46756690f961e3\runtime\bin\vcruntime140_1.dll
Size 48KB
SHA256 7dd9aa02e271c68ca6d5f18d651d23a15d7259715af43326578f7dde27f37637
MD5 2bd576cbc5cb712935eb1b10e4d312f5
SHA1 dfa7a46012483837f47d8c870973a2dea786d9ff
SHA512 abbd3eb628d5b7809f49ae08e2436af3d1b69f8a38de71ede3d0cb6e771c7758e35986a0dc0743b763ad91fd8190084ee5a5fbe1ac6159eb03690ccc14c64542
SSDEEP 768:IzzO6ujT3MbR3vXCz6S5Mq83yJ9d3+DuO9zUgElq9z6m:Fq/XuA3o9dgzUZWz5
TLSH
T17C235C9457784086D59F95B0C1D6EE537E7CFA964B00928F0BA1E1882F637D0EB3D22B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zip.dll

Path C:\Users\Admin\AppData\Local\Synostub\Hello\1a46756690f961e3\runtime\bin\zip.dll
Size 87KB
SHA256 6009721e1a23a8aaf79f8f9ef36c298bce3311b1b969c2982a2a5691c3ccfe43
MD5 ddd9887b03d232b4a844745cc5b4309b
SHA1 17cd434909113cd2e3285dde1541f89666ac4a96
SHA512 eb861060ac429779d28a7083a6f0f6a2309e2f0f686d67b4906620d90187689c8c6cd7999ef8735cf2b9129fc9d8e757a7847daf8a806c9bb0ab792ac34c5b0e
SSDEEP 1536:OF3PfYq1vEEnjnqCRHH3ATfKWVIOQIOhW5l/7VIvF:OF3PfYqBEEjnqCOfdGhW5l/+vF
TLSH
T115939D9589A04295DAFB91B0C9F64A3EC3BAB0111790578B635C879A2F537613F0C3FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.cfg

Path C:\Users\Admin\AppData\Local\Synostub\Hello\1a46756690f961e3\runtime\lib\jvm.cfg
Size 29B
SHA256 aa9efb969444c1484e29adecab55a122458090616e766b2f1230ef05bc3867e0
MD5 7ce21bdcfa333c231d74a77394206302
SHA1 c5a940d2dee8e7bfc01a87d585ddca420d37e226
SHA512 8b37a1a5600e0a4e5832021c4db50569e33f1ddc8ac4fc2f38d5439272b955b0e3028ea10dec0743b197aa0def32d9e185066d2bac451f81b99539d34006074b
MD5 SHA1 SHA512

Submit Download

modules

Path C:\Users\Admin\AppData\Local\Synostub\Hello\1a46756690f961e3\runtime\lib\modules
Size 24.6MB
SHA256 1e85d0c7e97cd670528ecde98b23ca2337e0a10f10e198e57194bdfb538e292d
MD5 d88e901c50bafb76abc3e0ca5f93f0ad
SHA1 c11ad6ef1e2da1dc329d79a060adb743b96b7fbf
SHA512 b20c976a326e24491a7e00fa58a8209305b7b8c958efb160146887828739b923031edc0fd5ddf1f2bcaa0b93777ab87add22c746c74dc5b3640662d2be2d44ba
SSDEEP 196608:JwzoR/DINBH/euULEmXG18hM4fV8mBQtVAlM:Jm29hvM
TLSH
T128473A1BF01566A7F281F7BE546103181320E4359843E2A29F2E8D2BFEE71D6CE756D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

release

Path C:\Users\Admin\AppData\Local\Synostub\Hello\1a46756690f961e3\runtime\release
Size 44B
SHA256 16f2a6e1080e7c9c1cf0279af7dd0128cc8a5d5021e98f90ba615d8d7396bac7
MD5 e8adc27d142149d24eb399bbf9fa3a14
SHA1 f24bf401d4e480d342624c0836b37ffe490be271
SHA512 805d19fef3da6a1b4198737f7d9cab396fdc4deb975170cd864349c39aca858e461723f4374871d861db685be2c66357f9c95cacf7425201c090b0abf08a7516
MD5 SHA1 SHA512

Submit Download

memory/4408-121-0x0000024850AB0000-0x0000024850D20000-memory.dmp

Download

memory/4408-133-0x0000024849580000-0x00000248497F0000-memory.dmp

Download

memory/4408-132-0x0000024851040000-0x00000248512B0000-memory.dmp

Download

memory/4408-144-0x0000024849580000-0x00000248497F0000-memory.dmp

Download

memory/4408-143-0x0000024851040000-0x00000248512B0000-memory.dmp

Download

memory/4408-142-0x0000024850AB0000-0x0000024850D20000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads