1ce26b06c49476461d900c1d07098b6c985893e0332f2cbbbbd045de832200ce

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 02:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_6f7e417124110932b54ab7afa6a2d689_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar.exe
Size 1.5MB
Sample260731-df49dsbf69
SHA256 1ce26b06c49476461d900c1d07098b6c985893e0332f2cbbbbd045de832200ce
MD5 6f7e417124110932b54ab7afa6a2d689
SHA1 ce448e5ded99581c354e6460f94ae8d378c562ff
SHA512 4c8aeadf239f98245cc1191fae46fb4aeea842734574ed819b045bc1191bc801a0e8c93a9731e5dcd236b4eb85bd0cc08f422870c980b3ba9e950e8384953e64
SSDEEP 24576:77Gzs4LjZVsghsoY0OE/6vk84yis93wEsk+RzNN:7JgjZVs0sxTEic84xUs7dNN
TLSH
T141757B03F69884E8C45EC07CC7169636EA76B88D0A31B6EF27D41B253E66FA06F1D354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4788	powershell.exe
3796	powershell.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4788	powershell.exe
4788	powershell.exe
4788	powershell.exe
3796	powershell.exe
3796	powershell.exe
3796	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4788	powershell.exe
Token: SeDebugPrivilege	3796	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 4788	2180	2026-07-31_6f7e417124110932b54ab7afa6a2d689_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar.exe	86
PID 2180 wrote to memory of 3796	2180	2026-07-31_6f7e417124110932b54ab7afa6a2d689_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-31_6f7e417124110932b54ab7afa6a2d689_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_6f7e417124110932b54ab7afa6a2d689_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Get-Process | Select-Object -ExpandProperty ProcessName"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Get-Process | Select-Object -ExpandProperty ProcessName"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 1022ec2fed08ff473817fc53893e192a8e33e6a16f3d2c8cb6fd37f49c938e1e
MD5 223bd4ae02766ddc32e6145fd1a29301
SHA1 900cfd6526d7e33fb4039a1cc2790ea049bc2c5b
SHA512 648cd3f8a89a18128d2b1bf960835e087a74cdbc783dbfcc712b3cb9e3a2e4f715e534ba2ef81d89af8f60d4882f6859373248c875ceb26ad0922e891f2e74cc
TLSH
T10A610E323375B1D4C9567F072E2819C053BF8396EA94AF5CB29C621ED92641B8F122F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 9d298952a71d68f818dcc385129aff23aaec0926bd86e9261904c8ff753d3807
MD5 b49c84296b6485bbc031a4b41ef4106d
SHA1 c671326eeafa79e8dd615b73a078c226e1498ad0
SHA512 f5ffb07d53c134361f233ca20aa29c79e8837ced589afe5c7c3bcc8a2772b4c6f0484b1aa78f8b36f751b844779c2b108e10514d2245bb89bdba49754a3d2779
TLSH
T17E21A827B3DC8A21CC86163A109D9C1172B283C7809ECF9FAFC4D600A07F598CB31294
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_uo1yxhyh.gya.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uo1yxhyh.gya.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3796-14-0x00000280B2600000-0x00000280B2610000-memory.dmp

Download

memory/3796-13-0x00000280B2600000-0x00000280B2610000-memory.dmp

Download

memory/4788-1-0x00000144B9270000-0x00000144B9280000-memory.dmp

Download

memory/4788-0-0x00000144B9270000-0x00000144B9280000-memory.dmp

Download

memory/4788-9-0x00000144B9240000-0x00000144B9262000-memory.dmp

Download