Analysis

  • max time kernel
    151s
  • max time network
    156s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 05:59

General

  • Target
    2026-08-02_8140bd5004239cc6b2449b26cc462361_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
  • Size 47.2MB
  • Sample260802-gpwkdswbqe
  • SHA256 dbbe11fb5f6a3da2fa849a00962486800364db0d0802ab931254d25d53ebb033
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_8140bd5004239cc6b2449b26cc462361_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-02_8140bd5004239cc6b2449b26cc462361_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3304
    • C:\Users\Admin\AppData\Local\Temp\2026-08-02_8140bd5004239cc6b2449b26cc462361_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-02_8140bd5004239cc6b2449b26cc462361_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe" gateway --host 127.0.0.1 --port 9765 --remote-host 0.0.0.0 --remote-port 59765 --gateway-idle-timeout-secs 300 --name gateway-for-dcc-mcp-server
      2⤵
      • Modifies trusted root certificate store through registry
      • Modifies system certificate store
      PID:6124
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:3028
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s CaptureService
      1⤵
        PID:2372

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            services.json

            • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
            • Size 1KB
            • SHA256 e3271fd61cf21b460093b8c6169c9bf8f33b93900391ad92c5335b2d657f2140
            • MD5 SHA1 SHA512 TLSH

            services.json

            • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
            • Size 1KB
            • SHA256 c04c977ffe134eb502f7a50d55cfceec72f6fa1c9ae09a01728f41e0caa567bf
            • MD5 SHA1 SHA512 TLSH

            services.json

            • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
            • Size 2KB
            • SHA256 a54ac9aa0435a21dcd8e3f44ba76540e2eeda47f399ef785c35873d473292872
            • MD5 SHA1 SHA512 TLSH

            services.json

            • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
            • Size 2KB
            • SHA256 bb8462bbb11c4c971509f21fd6ae0847d1ff44e6959251e7f6906c44c347d5a1
            • MD5 SHA1 SHA512 TLSH

            services.json

            • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
            • Size 2KB
            • SHA256 c38282c66f4ce60aaede300b7f6c95d3709bc182ad2aa0a3f2b593c0d946b653
            • MD5 SHA1 SHA512 TLSH

            services.json

            • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
            • Size 2KB
            • SHA256 4d76a4708ac69594cdfbf794999bf49e2ac5ca44caf817030a82271b8594a3ee
            • MD5 SHA1 SHA512 TLSH

            services.json

            • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
            • Size 2KB
            • SHA256 d0ed11cb76edd77e64c8bc688386b1468614dc5928c70812855be6613d0ed1c6
            • MD5 SHA1 SHA512 TLSH

            services.json

            • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
            • Size 2KB
            • SHA256 fb7a7f2125599a2be5ed7167a12aff7ad1b30de5a0d4f6e9a62fe3710efb3667
            • MD5 SHA1 SHA512 TLSH

            services.json

            • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
            • Size 2KB
            • SHA256 dbf1640650331d1acbe22424b0e2a8b9057e168bf0bbb6ac71fb000f95bcf916
            • MD5 SHA1 SHA512 TLSH

            services.json

            • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
            • Size 2KB
            • SHA256 871eba6070739c3cd9f59812f1a359e634f8f3e45c276537ef4552f2e5f9fa4d
            • MD5 SHA1 SHA512 TLSH

            services.json

            • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
            • Size 2KB
            • SHA256 a61d35a346d511fa623eed95bd0d9716e978f974ed655f4b6575e9099efea2c4
            • MD5 SHA1 SHA512 TLSH

            services.json

            • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
            • Size 2KB
            • SHA256 ff056e1b5857933035c476850304f3be7200cbe60f3c5f92d978e313c3d5cd73
            • MD5 SHA1 SHA512 TLSH

            services.json

            • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
            • Size 2KB
            • SHA256 a0edf8da2b0db715691faac66574f543e674641f95b6b30aebb93f88dbdd8440
            • MD5 SHA1 SHA512 TLSH

            services.json

            • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
            • Size 2KB
            • SHA256 5c0989fe39447756d87350a3971312608515ea58256e935c14a794ea8d59d773
            • MD5 SHA1 SHA512 TLSH

            services.json

            • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
            • Size 2KB
            • SHA256 fafd8ccf6ce491c1e17dfb6ae4c5b98352587ea26a0f5cc582862eca5dacc679
            • MD5 SHA1 SHA512 TLSH

            services.json

            • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
            • Size 2KB
            • SHA256 f3330366290c3c448303c9e968c0966d7a10ef9ea562779ddab5dab959492991
            • MD5 SHA1 SHA512 TLSH

            services.json

            • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
            • Size 2KB
            • SHA256 a989e5463087b4d72c129c55347610ad8c29deb50883ee94d58715fcd82fc5db
            • MD5 SHA1 SHA512 TLSH

            services.json

            • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
            • Size 2KB
            • SHA256 8bf202bcc4ba5a9d9ee1fd8c7d36fd431366a8732567d2d836b1b1a07f39678d
            • MD5 SHA1 SHA512 TLSH

            services.json

            • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
            • Size 2KB
            • SHA256 51e1cd63465db89d9cc724578c292ec91ce4b0c6c1b9cfff63841caf8a934dac
            • MD5 SHA1 SHA512 TLSH

            services.json

            • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
            • Size 2KB
            • SHA256 3174846c3310e51d9542c838bfdb8f3938062bdaab8f27d27ccd5277a04adde6
            • MD5 SHA1 SHA512 TLSH

            services.json

            • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
            • Size 2KB
            • SHA256 6fd737c55a635062a2c33716a77183981994094d10d5137198082571344d5dd2
            • MD5 SHA1 SHA512 TLSH

            services.json

            • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
            • Size 2KB
            • SHA256 2bb72433d47d6eff5cb3cd9ca30e62cbe72d77e8b868cee4f9e3deabb1809fe1
            • MD5 SHA1 SHA512 TLSH

            services.json

            • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
            • Size 2KB
            • SHA256 ee99c8aad94c99efabfe5aaedba5a6056c5360af54cf63e5e451995e2f0ed084
            • MD5 SHA1 SHA512 TLSH

            services.json

            • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
            • Size 2KB
            • SHA256 b5315dac9c9d2b7d9be9f04c8987df7f473ba82fa05beacff0a2b4d6f0e119e3
            • MD5 SHA1 SHA512 TLSH

            services.json

            • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
            • Size 2KB
            • SHA256 bf94a8e8eac7a2df7146e7d63373d77d7717b30b5791dbe05ac5a676e2b55d61
            • MD5 SHA1 SHA512 TLSH

            services.json

            • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
            • Size 2KB
            • SHA256 54c0d99061d66474c61c31923bdaa1075bf4f72fceb12b74600d2a3e2f20599f
            • MD5 SHA1 SHA512 TLSH

            services.json

            • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
            • Size 2KB
            • SHA256 4ba2a2c8ec11cfdfbc326c23bf5c6a35f1a32db17af655555b479f52cdd86401
            • MD5 SHA1 SHA512 TLSH

            services.json

            • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
            • Size 2KB
            • SHA256 f6c5f1d0472235ac458a56af227681f56eb68474a50bde26ccbe9340c1ba17d3
            • MD5 SHA1 SHA512 TLSH

            services.json

            • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
            • Size 2KB
            • SHA256 07e03934601655f44891fede8522d5abb1ddc6136c5108611016d05b247a75e9
            • MD5 SHA1 SHA512 TLSH

            services.json

            • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
            • Size 2KB
            • SHA256 19f8cd87b31c5e7c58ae391e30a6d4d70e9e0df4637c61ca71ba0bfde76d5979
            • MD5 SHA1 SHA512 TLSH

            services.json

            • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
            • Size 2KB
            • SHA256 7e5f32e96c4498bfb35dfef1608d43544fb34da144603c7dc8f7776377d89071
            • MD5 SHA1 SHA512 TLSH

            services.json

            • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
            • Size 2KB
            • SHA256 f273a90e354ebe8d75defa9828050b7a0bbb3ab0a005345547d4dbf9f35c55f1
            • MD5 SHA1 SHA512 TLSH

            services.json

            • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
            • Size 2KB
            • SHA256 2d6365fffa9bd0de358e5b19d190573f90547734c8dbe1cacacb9ade32e3374e
            • MD5 SHA1 SHA512 TLSH

            services.json

            • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
            • Size 2KB
            • SHA256 b34e5de67be6f72d241c87a536725a92a30a3dffada8077429f0aa28c41e1efd
            • MD5 SHA1 SHA512 TLSH

            services.json

            • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
            • Size 2KB
            • SHA256 ea742d07dac6c32a485ba9bdcf6e5bf81b81e29c96b0518125c77a852f62374e
            • MD5 SHA1 SHA512 TLSH

            services.json

            • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
            • Size 2KB
            • SHA256 c292059a3372021e98e95123f1a39ce9a79dc8566231e7871ae3b2269ca2d822
            • MD5 SHA1 SHA512 TLSH

            services.json

            • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
            • Size 2KB
            • SHA256 f98a7e20e0964712ee04278fdd5328f289a98d92ad97640c52c3aa6242004654
            • MD5 SHA1 SHA512 TLSH

            services.json

            • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
            • Size 2KB
            • SHA256 7fe48a8f8c5c3c9d763b3e142ceab6cf43d667ba93e5823773d35043058e1845
            • MD5 SHA1 SHA512 TLSH

            services.json

            • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
            • Size 2KB
            • SHA256 9392c6dbfdffaad034364384e469b15ba8729e5f8894d5775ab616e26e16584b
            • MD5 SHA1 SHA512 TLSH

            services.json

            • Path C:\Users\Admin\AppData\Local\Temp\dcc-mcp-registry\services.json
            • Size 2KB
            • SHA256 6de824be38c93b770a1a85130bc1632f0a152599b80a0191df753db709dcd161
            • MD5 SHA1 SHA512 TLSH

            gateway_admin.sqlite

            • Path C:\Users\Admin\AppData\Local\dcc-mcp\gateway_admin.sqlite
            • Size 156KB
            • SHA256 0068bf4973c95a4f3a63d6a5a6e129a36f349fa2b30095b91ded3227992ff330
            • MD5 SHA1 SHA512 SSDEEP TLSH