9b33f88d9a1bfe510f44b89b2b0f68c546e9fc2cc9c43af05884979e74832b51

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 05:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_848eda8110b95612b4f0342c8d192667_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
Size 929KB
Sample260802-gm37fsdp81
SHA256 9b33f88d9a1bfe510f44b89b2b0f68c546e9fc2cc9c43af05884979e74832b51
MD5 848eda8110b95612b4f0342c8d192667
SHA1 45c565fb333c9e61b14315233ce358d9d0bdb3b0
SHA512 398a95433ddaf091e4cf96e0d8c599124a6a9d5417f0b37b097eec8e6df91cf6eaa7df760134ff97c684486df48953787a2f21a454d6a0148282aac267320795
SSDEEP 12288:ImcJNDBcN3E5cXVSqHb1dLcNXmz0Cv8E4wVlsjizH1T25VMvN0wa1ljA1B/w8rSj:ImcJNNseckqHb+mQOV0wa1lGlRrSN
TLSH
T14C155A0BF59460E8E05FC035872952E2EB6F786E071178AB80E8632C3F54BE51EBDB55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

persistence

Malware Config

Signatures

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	2026-08-02_848eda8110b95612b4f0342c8d192667_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	2026-08-02_848eda8110b95612b4f0342c8d192667_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\GroupPolicy\User\Scripts\Logon\DialogueSync.bat	2026-08-02_848eda8110b95612b4f0342c8d192667_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\GroupPolicy\User\Scripts\scripts.ini	2026-08-02_848eda8110b95612b4f0342c8d192667_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	2026-08-02_848eda8110b95612b4f0342c8d192667_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\logs\StorGroupPolicy.log	svchost.exe

Runs net.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 4760	2832	2026-08-02_848eda8110b95612b4f0342c8d192667_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	89
PID 4760 wrote to memory of 4644	4760	net.exe	91
PID 2832 wrote to memory of 4748	2832	2026-08-02_848eda8110b95612b4f0342c8d192667_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	92
PID 4748 wrote to memory of 5884	4748	net.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-02_848eda8110b95612b4f0342c8d192667_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_848eda8110b95612b4f0342c8d192667_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Windows\system32\net.exe
  "net" session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4760
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:4644
- C:\Windows\system32\net.exe
  "net" session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4748
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:5884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:1808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
- Drops file in Windows directory
PID:2000

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:5844

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gpt.ini

Path C:\Windows\System32\GroupPolicy\gpt.ini
Size 128B
SHA256 80631bac5e5a8892e71e09750c92924086ca744fdd7be2865cfe6350fed72f9e
MD5 8e6524f0b69b883d2a08f51cd5309135
SHA1 94c51406cf97993cf419b84e82d67c4e9bb3574a
SHA512 046417cf93f6cf187a1ae4a48c96df7157ddab15f729b875aeb1d07e970dc459a170e1af02b432bc0fb53fcc3c49a0d67063c1b2bfc655af344c8bf47427ce04
TLSH
T13CB02B1208C22110C014765281542950C1703E4045604CAFE049B08C337075B8046D0D
MD5 SHA1 SHA512 TLSH