f41a046e4f9a3b1c1a93c0984c2b17bb19f87d766f377ad7aba2113d3db89413

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 04:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_0194b70255ed750878dc9c38f5e3bdf5_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Size 298KB
Sample260714-fbqljsgx6v
SHA256 f41a046e4f9a3b1c1a93c0984c2b17bb19f87d766f377ad7aba2113d3db89413
MD5 0194b70255ed750878dc9c38f5e3bdf5
SHA1 d7629e6c5688c86f8783d2723ae94e71fd40f8ff
SHA512 e0ff4021b94846cc38cf910b14323c69d27453e48cd36ae3486e1c320190422e1dca24c1107bdb28e9c26c01304056809ee30c31d44be572696601409e4e8d25
SSDEEP 6144:UneQb4OAhTKRlXDQN5wXSwie9nzwgEUE9p17qz50XjgeeYzgwG0gq83HNTDlWUWK:Ueo4YXDhEZP4YFGD
TLSH
T1BF543B25BA56A4ACD55BC07883468A726971B4CA1B31B9FF02C441383FAEEF52F3C754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3144	systemhelper.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3128	2026-07-14_0194b70255ed750878dc9c38f5e3bdf5_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3128 wrote to memory of 3144	3128	2026-07-14_0194b70255ed750878dc9c38f5e3bdf5_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	87
PID 3128 wrote to memory of 5936	3128	2026-07-14_0194b70255ed750878dc9c38f5e3bdf5_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	88

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5936	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-14_0194b70255ed750878dc9c38f5e3bdf5_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_0194b70255ed750878dc9c38f5e3bdf5_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3128
- C:\Users\Public\Libraries\systemhelper.exe
  "C:\Users\Public\Libraries\systemhelper.exe"
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-14_0194b70255ed750878dc9c38f5e3bdf5_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe_old.bak
  2⤵
  - Views/modifies file attributes
  PID:5936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

systemhelper.exe

Path C:\Users\Public\Libraries\systemhelper.exe
Size 298KB
SHA256 3a8bce578f9c413cb0fda726332330471c4255ebc53094b163814d8e1282762d
MD5 6543e244ef0f842974301ddab57b5fa5
SHA1 24045fb42ff2e83418447c9f269084dd8a45b39c
SHA512 5c1e525a0abde626ceedb1429471b3bcc2d2e7f38a7d6a5c1a1adcd2305549037fc63ada533c4f253aed6a70170bbfa1f9654a42f4b270e755964c9e8e78da59
SSDEEP 6144:UneQb4OAhTKRlXDQN5wXSwie9nzwgEUE9p17qz50XjgeeYzgwG0gq83HNTDlWUWp:Ueo4YXDhEZP4YFGi
TLSH
T1E4543B25BA56A4ACD55BC07883468A726971B4CA1B31B9FF02C441383FAEEF52F3C754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3128-4-0x00007FF638FC0000-0x00007FF63900E000-memory.dmp

Download