9861b9ca2ec325ae0e66eca89d027f2977c1822c1333130c5e2c3ed37b6cdd2d

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 04:33

Target
2026-07-14_0eb5cd583fdfb063ee842082644e2bdd_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
Size 2.5MB
Sample260714-e6vy3sgw4v
SHA256 9861b9ca2ec325ae0e66eca89d027f2977c1822c1333130c5e2c3ed37b6cdd2d
MD5 0eb5cd583fdfb063ee842082644e2bdd
SHA1 b1ca874a2872a3b0885c43e0862bbbc3a05eca2a
SHA512 5ff406e0bcd9115dd0da3a43301816cb15f8cf19341d64684a41e784edc72c0ede1937c54efb792b7ba0fc1f30b85fe1187640af1e450924c53de86113c3bba6
SSDEEP 49152:zZEXurRHg9orv/oKCQOydhYMJucKK6q3MqCc/9kDe8:zauTv/oFQOyrYMkcKzjw9kx
TLSH
T12FC5AE0AF1534AD5CC9BC0BC839B7131EB357D79CE282E9B17918B613E45B806725F8A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-07-14_0eb5cd583fdfb063ee842082644e2bdd_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-07-14_0eb5cd583fdfb063ee842082644e2bdd_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 3236	5064	2026-07-14_0eb5cd583fdfb063ee842082644e2bdd_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	87
PID 5064 wrote to memory of 3236	5064	2026-07-14_0eb5cd583fdfb063ee842082644e2bdd_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	87
PID 5064 wrote to memory of 4844	5064	2026-07-14_0eb5cd583fdfb063ee842082644e2bdd_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	88
PID 5064 wrote to memory of 4844	5064	2026-07-14_0eb5cd583fdfb063ee842082644e2bdd_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	88
PID 5064 wrote to memory of 2328	5064	2026-07-14_0eb5cd583fdfb063ee842082644e2bdd_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	89
PID 5064 wrote to memory of 2328	5064	2026-07-14_0eb5cd583fdfb063ee842082644e2bdd_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-14_0eb5cd583fdfb063ee842082644e2bdd_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_0eb5cd583fdfb063ee842082644e2bdd_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"
1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --incognito
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4844
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu
  2⤵
  PID:2328

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5828

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4148