Analysis
- max time kernel
150s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
04/08/2026, 19:48
General
- Target 2026-08-04_6ddfcf00b00f31863f06d7796673e59c_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
- Size 9.3MB
- Sample260804-yjkdlsdj7v
- SHA256 00beeceabd03ce130e6cfeff4a114b3eb8408dfd5e6e97c7dba7cff9c5fff858
Score
9/10
Malware Config
Signatures
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 6 IoCs
- Modifies RDP port number used by Windows 1 TTPs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_6ddfcf00b00f31863f06d7796673e59c_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_6ddfcf00b00f31863f06d7796673e59c_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exe"net" session2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session3⤵
-
-
-
C:\Windows\system32\cmd.execmd.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1908-0-0x00007FFA8EBA0000-0x00007FFA8EE03000-memory.dmp
memory/1908-1-0x0000023C8A500000-0x0000023C8A505000-memory.dmp
memory/1908-5-0x0000023C8ABB0000-0x0000023C8AC69000-memory.dmp
memory/1908-15-0x0000023C8ABB0000-0x0000023C8AC69000-memory.dmp
memory/1908-18-0x0000023C8ABB0000-0x0000023C8AC69000-memory.dmp
memory/1908-19-0x0000023C8ABB0000-0x0000023C8AC69000-memory.dmp
memory/1908-20-0x0000023C8ABB0000-0x0000023C8AC69000-memory.dmp
memory/1908-21-0x0000023C8A500000-0x0000023C8A505000-memory.dmp
memory/1908-22-0x0000023C8ABB0000-0x0000023C8AC69000-memory.dmp