Analysis
- max time kernel
149s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
04/08/2026, 11:40
General
- Target 2026-08-03_612ed3c6066f785a1e3a6d60c1ce4930_akira_cobalt-strike_glassworm_megazord_rusty-stealer_satacom.exe
- Size 14.6MB
- Sample260804-ns91hsdp5s
- SHA256 854da76c79e3edf7e9406301be1b5689a42ff0f9bdb4d40295ef236dacec780a
Score
6/10
Malware Config
Signatures
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Modifies trusted root certificate store through registry 1 TTPs 2 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies system certificate store 2 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_612ed3c6066f785a1e3a6d60c1ce4930_akira_cobalt-strike_glassworm_megazord_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_612ed3c6066f785a1e3a6d60c1ce4930_akira_cobalt-strike_glassworm_megazord_rusty-stealer_satacom.exe"1⤵
- Checks whether UAC is enabled
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-03_612ed3c6066f785a1e3a6d60c1ce4930_akira_cobalt-strike_glassworm_megazord_rusty-stealer_satacom.exe --webview-exe-version=0.5.1 --user-data-dir="C:\Users\Admin\AppData\Local\com.halal.halaldl\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=3692.1892.878871907146493416 /pfhostedapp:592a951ea758ec2a2f0f9545dcec1328d32e7b2c2⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.halal.halaldl\EBWebView /prefetch:4 /pfhostedapp:592a951ea758ec2a2f0f9545dcec1328d32e7b2c --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.halal.halaldl\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffc64ff5fd8,0x7ffc64ff5fe4,0x7ffc64ff5ff03⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.halal.halaldl\EBWebView" --webview-exe-name=2026-08-03_612ed3c6066f785a1e3a6d60c1ce4930_akira_cobalt-strike_glassworm_megazord_rusty-stealer_satacom.exe --webview-exe-version=0.5.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1744 --field-trial-handle=1748,i,6120324090492317748,16689464062980578719,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:592a951ea758ec2a2f0f9545dcec1328d32e7b2c3⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.halal.halaldl\EBWebView" --webview-exe-name=2026-08-03_612ed3c6066f785a1e3a6d60c1ce4930_akira_cobalt-strike_glassworm_megazord_rusty-stealer_satacom.exe --webview-exe-version=0.5.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2044 --field-trial-handle=1748,i,6120324090492317748,16689464062980578719,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:592a951ea758ec2a2f0f9545dcec1328d32e7b2c3⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.halal.halaldl\EBWebView" --webview-exe-name=2026-08-03_612ed3c6066f785a1e3a6d60c1ce4930_akira_cobalt-strike_glassworm_megazord_rusty-stealer_satacom.exe --webview-exe-version=0.5.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2272 --field-trial-handle=1748,i,6120324090492317748,16689464062980578719,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:592a951ea758ec2a2f0f9545dcec1328d32e7b2c3⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.halal.halaldl\EBWebView" --webview-exe-name=2026-08-03_612ed3c6066f785a1e3a6d60c1ce4930_akira_cobalt-strike_glassworm_megazord_rusty-stealer_satacom.exe --webview-exe-version=0.5.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3400 --field-trial-handle=1748,i,6120324090492317748,16689464062980578719,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:592a951ea758ec2a2f0f9545dcec1328d32e7b2c /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.halal.halaldl\EBWebView" --webview-exe-name=2026-08-03_612ed3c6066f785a1e3a6d60c1ce4930_akira_cobalt-strike_glassworm_megazord_rusty-stealer_satacom.exe --webview-exe-version=0.5.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=832 --field-trial-handle=1748,i,6120324090492317748,16689464062980578719,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:592a951ea758ec2a2f0f9545dcec1328d32e7b2c3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $productName = 'HalalDL' $currentVersion = '0.5.1' $currentExePath = 'C:\Users\Admin\AppData\Local\Temp\2026-08-03_612ed3c6066f785a1e3a6d60c1ce4930_akira_cobalt-strike_glassworm_megazord_rusty-stealer_satacom.exe' $currentExeDir = 'C:\Users\Admin\AppData\Local\Temp' $registryPaths = @( 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*', 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*', 'HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*' ) $items = foreach ($path in $registryPaths) { Get-ItemProperty -Path $path -ErrorAction SilentlyContinue | Where-Object { $_.DisplayName -and ($_.DisplayName -eq $productName -or $_.DisplayName -like ($productName + '*')) } | ForEach-Object { $displayName = [string]$_.DisplayName $displayVersion = [string]$_.DisplayVersion $displayIcon = [string]$_.DisplayIcon $installLocation = [string]$_.InstallLocation $installSource = [string]$_.InstallSource $uninstallString = [string]$_.UninstallString $quietUninstallString = [string]$_.QuietUninstallString $combined = ($uninstallString + ' ' + $quietUninstallString + ' ' + $displayIcon + ' ' + $installSource).Trim() $installerType = 'unknown' if ($_.WindowsInstaller -eq 1 -or $combined -match '(?i)\bmsiexec(\.exe)?\b') { $installerType = 'msi' } elseif ($combined -match '(?i)unins[0-9]*\.exe|\\uninstall\.exe\b|nsis') { $installerType = 'nsis' } $installScope = if ($_.PSPath -like 'Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE*') { 'machine' } else { 'user' } $score = 0 if ($displayName -eq $productName) { $score += 40 } elseif ($displayName -like ($productName + '*')) { $score += 10 } if ($installLocation) { $normalizedInstall = $installLocation.TrimEnd('\') if ($currentExeDir -ieq $normalizedInstall -or $currentExeDir -like ($normalizedInstall + '\*')) { $score += 200 } } if ($displayIcon -and $displayIcon -like ('*' + $currentExePath + '*')) { $score += 200 } if ($combined -and $combined -like ('*' + $currentExeDir + '*')) { $score += 120 } if ($displayVersion -and $displayVersion -eq $currentVersion) { $score += 60 } if ($installerType -ne 'unknown') { $score += 20 } [pscustomobject]@{ installerType = $installerType installScope = $installScope installDir = if ($installLocation) { $installLocation } else { $null } uninstallCommand = if ($combined) { $combined } else { $null } detectedFrom = 'registry' registryKey = $_.PSChildName score = $score } } } if (-not $items) { $fallbackType = 'unknown' if (Test-Path (Join-Path $currentExeDir 'uninstall.exe')) { $fallbackType = 'nsis' } [pscustomobject]@{ installerType = $fallbackType installScope = 'unknown' installDir = if ($currentExeDir) { $currentExeDir } else { $null } uninstallCommand = $null detectedFrom = 'filesystem' registryKey = $null } | ConvertTo-Json -Compress exit 0 } $best = $items | Sort-Object -Property @( @{ Expression = 'score'; Descending = $true }, @{ Expression = 'installerType'; Descending = $false } ) | Select-Object -First 1 if (-not $best -or $best.score -lt 60) { $fallbackType = 'unknown' if (Test-Path (Join-Path $currentExeDir 'uninstall.exe')) { $fallbackType = 'nsis' } [pscustomobject]@{ installerType = $fallbackType installScope = 'unknown' installDir = if ($currentExeDir) { $currentExeDir } else { $null } uninstallCommand = $null detectedFrom = 'filesystem' registryKey = $null } | ConvertTo-Json -Compress exit 0 } $best | Select-Object installerType, installScope, installDir, uninstallCommand, detectedFrom, registryKey | ConvertTo-Json -Compress "2⤵
- Command and Scripting Interpreter: PowerShell
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
settings.dat
settings.dat
throttle_store.dat
the-real-index
the-real-index~RFe59938c.TMP
Network Persistent State
Network Persistent State~RFe5a6dcf.TMP
SCT Auditing Pending Reports
TransportSecurity
TransportSecurity~RFe59b0f7.TMP
Preferences
Preferences
Preferences~RFe59bc32.TMP
CURRENT
MANIFEST-000001
data_0
data_1
data_2
data_3
Local State
Local State
Local State
Local State
Local State~RFe59423f.TMP
memory/2028-297-0x000001C26EA40000-0x000001C26EA41000-memory.dmp
memory/2028-292-0x000001C26EA40000-0x000001C26EA41000-memory.dmp
memory/2028-290-0x000001C26EA40000-0x000001C26EA41000-memory.dmp
memory/2028-301-0x000001C26EA40000-0x000001C26EA41000-memory.dmp
memory/2028-300-0x000001C26EA40000-0x000001C26EA41000-memory.dmp
memory/2028-299-0x000001C26EA40000-0x000001C26EA41000-memory.dmp
memory/2028-298-0x000001C26EA40000-0x000001C26EA41000-memory.dmp
memory/2028-296-0x000001C26EA40000-0x000001C26EA41000-memory.dmp
memory/3152-80-0x00007FFC86750000-0x00007FFC86751000-memory.dmp
memory/4476-206-0x000001B74FE90000-0x000001B74FEB2000-memory.dmp
memory/4476-208-0x000001B750B30000-0x000001B751058000-memory.dmp
memory/4476-207-0x000001B750430000-0x000001B7505F2000-memory.dmp
memory/6092-26-0x00007FFC86750000-0x00007FFC86751000-memory.dmp