Analysis

  • max time kernel
    151s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    31/07/2026, 07:08

General

  • Target
    2026-07-31_a644eb58447e60b253e99ac08bdee799_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
  • Size 47.1MB
  • Sample260731-hyj4dsxalg
  • SHA256 b59ae6cd24ba3d82f93f8a5ffa67649e28dab2eac65af7f140e04fc3d0b2cf6b
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-31_a644eb58447e60b253e99ac08bdee799_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-31_a644eb58447e60b253e99ac08bdee799_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3264
    • C:\Users\Admin\AppData\Local\Temp\2026-07-31_a644eb58447e60b253e99ac08bdee799_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-31_a644eb58447e60b253e99ac08bdee799_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe" gateway --host 127.0.0.1 --port 9765 --remote-host 0.0.0.0 --remote-port 59765 --gateway-idle-timeout-secs 300 --name gateway-for-dcc-mcp-server
      2⤵
      • Modifies trusted root certificate store through registry
      • Modifies system certificate store
      PID:4776
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService -p -s CaptureService
    1⤵
      PID:4040

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          services.json

          • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
          • Size 1KB
          • SHA256 e8566518b706226c763ca7eb5df28cc41e99a1c085e5ca08179869f63c944602
          • MD5 SHA1 SHA512 TLSH

          services.json

          • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
          • Size 1KB
          • SHA256 eca260927f065dbeeb6a51434f4b83c73d8f80134c2086548316ce99d73b1522
          • MD5 SHA1 SHA512 TLSH

          services.json

          • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
          • Size 2KB
          • SHA256 ebfbc10ba1528c524309246834884bb31620204c7a231784b642e92bfff13e19
          • MD5 SHA1 SHA512 TLSH

          services.json

          • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
          • Size 2KB
          • SHA256 ad0a9ecc8ed85df5834f74680792a5b868f57803ba02f295ae8c36f902a90fdd
          • MD5 SHA1 SHA512 TLSH

          services.json

          • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
          • Size 2KB
          • SHA256 2c358116b18ee4ad73c0a8f7d21bd4fc98eb88aa7a3ecbcccfbce241833fe99a
          • MD5 SHA1 SHA512 TLSH

          services.json

          • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
          • Size 2KB
          • SHA256 6bb634a2d4d69471dc1098fd53e78af302acd5007778e94cfdebb389b14999ec
          • MD5 SHA1 SHA512 TLSH

          services.json

          • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
          • Size 2KB
          • SHA256 da335ed3005b21df5d8fe1e72d452b9b22a71fb4f3f2ce1b89c6823968ae52da
          • MD5 SHA1 SHA512 TLSH

          services.json

          • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
          • Size 2KB
          • SHA256 ac46057608e55aed0ff34960ad4e70e090a906c8f54f411ffc36e0a2d86e1d66
          • MD5 SHA1 SHA512 TLSH

          services.json

          • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
          • Size 2KB
          • SHA256 9c17dba5cfe864563653b11f8f7a9a9137942ccc5eb9963aa619ca09b81064cb
          • MD5 SHA1 SHA512 TLSH

          services.json

          • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
          • Size 2KB
          • SHA256 3ad820bd2fe54eee668e72e0a9f7d3f53be474598960083523e988edd1988c5d
          • MD5 SHA1 SHA512 TLSH

          services.json

          • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
          • Size 2KB
          • SHA256 e360c70ad772d7d39ac3a167bf63a52a48a52be2b50115fea60220313e436ba6
          • MD5 SHA1 SHA512 TLSH

          services.json

          • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
          • Size 2KB
          • SHA256 b1c914d08f27aa1ed731f9acfdf6d209575e168295d9af0df7f89a5c799787ac
          • MD5 SHA1 SHA512 TLSH

          services.json

          • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
          • Size 2KB
          • SHA256 02b153155c1fc9227cf005969112d3bef4e3e115542cb99076048c1aa0ef20a0
          • MD5 SHA1 SHA512 TLSH

          services.json

          • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
          • Size 2KB
          • SHA256 64357b04387ddaecfcaf440b038097284ba53dbe68951481d206007fc48f3ae0
          • MD5 SHA1 SHA512 TLSH

          services.json

          • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
          • Size 2KB
          • SHA256 e841b7685c8870cfa2f7ebfec43c91198f8e0ec5c393ec1209080e6995cff379
          • MD5 SHA1 SHA512 TLSH

          services.json

          • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
          • Size 2KB
          • SHA256 f0a5a2c14255a7bfeb42c58563b275d5945dce9ad862aecde5135a42ac8f03b0
          • MD5 SHA1 SHA512 TLSH

          services.json

          • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
          • Size 2KB
          • SHA256 55ce2240f02af49cf4b9f110126202311c59a62ac6292051aa9f30256cd016c6
          • MD5 SHA1 SHA512 TLSH

          services.json

          • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
          • Size 2KB
          • SHA256 cdf9e319a964e361d9a5711c2e5e461325f8abb1a7b41469de05a42b131736f2
          • MD5 SHA1 SHA512 TLSH

          services.json

          • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
          • Size 2KB
          • SHA256 1bc345d11127e280ff44910493ba707737a06f1f0f25430135fdb18dfce198f8
          • MD5 SHA1 SHA512 TLSH

          services.json

          • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
          • Size 2KB
          • SHA256 89f963b44f8ac5cbd4cc25689e9513e510eb18491a916910dfd891c8044f3472
          • MD5 SHA1 SHA512 TLSH

          services.json

          • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
          • Size 2KB
          • SHA256 7b6e0a8b06265725e1900f50dbe1de13040502943771cfd298293dbe5396ba79
          • MD5 SHA1 SHA512 TLSH

          services.json

          • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
          • Size 2KB
          • SHA256 970ecbeb8ac611a4ee4f8476a3dae5b5951ff009d55b680888a00aa63c59f1ad
          • MD5 SHA1 SHA512 TLSH

          services.json

          • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
          • Size 2KB
          • SHA256 6e19c9b243e99e85c84175fc3a9890cadfe5172834ae011b001fdc1e82737f97
          • MD5 SHA1 SHA512 TLSH

          services.json

          • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
          • Size 2KB
          • SHA256 3f36010e3c005e1058f289de16084c58a0e926d9ca1a0b95f53e1b470f2c9af1
          • MD5 SHA1 SHA512 TLSH

          services.json

          • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
          • Size 2KB
          • SHA256 5d3612541ce5be680a2f7faef494ac3b9edc46d918bfa95261f5827a39fc2990
          • MD5 SHA1 SHA512 TLSH

          services.json

          • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
          • Size 2KB
          • SHA256 44c58ec5a2fda5d99439898f570c7350d1e6dcaf1de3cac6166c428230af2b1a
          • MD5 SHA1 SHA512 TLSH

          services.json

          • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
          • Size 2KB
          • SHA256 4e2820d26705decf542c67ceac783198cbb7185c67672cb13614da6df7f78224
          • MD5 SHA1 SHA512 TLSH

          services.json

          • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
          • Size 2KB
          • SHA256 92590ea8e045171b19e3b3c5714ee4b276a9ce726b3527295450958d1cf7d8e6
          • MD5 SHA1 SHA512 TLSH

          services.json

          • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
          • Size 2KB
          • SHA256 83e50f0a30e49002372ed830bb672d278dffd9647aed5972226b8010ee436cdc
          • MD5 SHA1 SHA512 TLSH

          services.json

          • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
          • Size 2KB
          • SHA256 90119743a6322b543caf9c28a7d14c3e92a1cd859133ab14afa04c7b928e076f
          • MD5 SHA1 SHA512 TLSH

          services.json

          • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
          • Size 2KB
          • SHA256 9fe764afd32593850666bba1d8b0c9fa2f498eda7c9004dcbda8e56ad74555cb
          • MD5 SHA1 SHA512 TLSH

          services.json

          • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
          • Size 2KB
          • SHA256 50449ee03afb823713d71c0a029c278fb80373e6a5122f16d86b64ce795ffa7d
          • MD5 SHA1 SHA512 TLSH

          services.json

          • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
          • Size 2KB
          • SHA256 5cefdf87fbb3abd21257fd6256ea917db066936e63dd8b6f4f0f4911a452590b
          • MD5 SHA1 SHA512 TLSH

          services.json

          • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
          • Size 2KB
          • SHA256 99259dad2eb4464c22387361afd3e50d92a6ae458d99a6fb1386c91e0315fa7a
          • MD5 SHA1 SHA512 TLSH

          services.json

          • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
          • Size 2KB
          • SHA256 b64cdb6966097b41c2f8d36b8afc7514198cce318e648b509c159307450689ca
          • MD5 SHA1 SHA512 TLSH

          services.json

          • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
          • Size 2KB
          • SHA256 902d8ea23842c358bb7980a85b1d4dd339197ae7c87d1cdf78e78da347caf4de
          • MD5 SHA1 SHA512 TLSH

          services.json

          • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
          • Size 2KB
          • SHA256 4f7c85f841a2b3fe605ea8832b4f3c592d02a22697f3312d9a939e1742fb6d35
          • MD5 SHA1 SHA512 TLSH

          services.json

          • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
          • Size 2KB
          • SHA256 7d1b3d37686e57f74c52c9e24bba3a9a47169414dc74d62174ed1c526dc906b7
          • MD5 SHA1 SHA512 TLSH

          services.json

          • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
          • Size 2KB
          • SHA256 33e010db914bc3dc9e677bb57da36abac7e6157ecce9a80c732bb1bf18595ea2
          • MD5 SHA1 SHA512 TLSH

          services.json

          • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
          • Size 2KB
          • SHA256 41a2d00973a4f20a169e3de44d7109cbd017fd6abfc9fe4c24c1c9057ca31b6f
          • MD5 SHA1 SHA512 TLSH

          services.json

          • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
          • Size 2KB
          • SHA256 3198022a52f62d55458893431b0032289a291842e0406b297580cb8c3002e31f
          • MD5 SHA1 SHA512 TLSH

          gateway_admin.sqlite

          • Path C:\Users\Admin\AppData\Local\dcc-mcp\gateway_admin.sqlite
          • Size 156KB
          • SHA256 0068bf4973c95a4f3a63d6a5a6e129a36f349fa2b30095b91ded3227992ff330
          • MD5 SHA1 SHA512 SSDEEP TLSH