Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
14/07/2026, 04:26
General
- Target 2026-07-14_19c66f5ea24ac46ae98d153946c5d47b_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
- Size 12.5MB
- Sample260714-e2k83sgv3v
- SHA256 4364d88a23fd2c3dc73b7fc9c4ac946efddc774d96fedae03c523de8c2611e32
Score
3/10
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-14_19c66f5ea24ac46ae98d153946c5d47b_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-14_19c66f5ea24ac46ae98d153946c5d47b_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -NoProfile -ExecutionPolicy Bypass -Command "$names=@('OpenAI.Codex','OpenAI.CodexBeta'); Get-AppxPackage | Where-Object { $names -contains $_.Name } | Sort-Object Version -Descending | Select-Object -First 1 -ExpandProperty InstallLocation"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_05xofvr1.lpg.ps1
memory/5012-1-0x0000020553770000-0x0000020553780000-memory.dmp
memory/5012-0-0x0000020553770000-0x0000020553780000-memory.dmp
memory/5012-2-0x000002056E290000-0x000002056E2B2000-memory.dmp
memory/5012-10-0x000002056DEA0000-0x000002056DEB6000-memory.dmp
memory/5012-11-0x000002056DEC0000-0x000002056DECA000-memory.dmp
memory/5012-12-0x000002056DF30000-0x000002056DF56000-memory.dmp