accbbf389c1b7ab917b18bf08b10980882e520d4eea5150366b4171059b6fe2f

Analysis

max time kernel
149s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 23:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_b37c253a305d879ca66b5b0251ec8c0e_akira_cobalt-strike_rusty-stealer_satacom.exe
Size 681KB
Sample260805-2z1mbaed84
SHA256 accbbf389c1b7ab917b18bf08b10980882e520d4eea5150366b4171059b6fe2f
MD5 b37c253a305d879ca66b5b0251ec8c0e
SHA1 241c50fc1ef6aa471e677993be345779dd7989c4
SHA512 319dc2b8f5c6d52389abb89018dc1e6c41f5ad976fbd03e7370357da5508a5bc94a413c4a4c4b92fe5895cb54d94d939c677bd6b7be88890815c006a319f5eb4
SSDEEP 12288:BR69dGnVuMZNR/XxzzfmT0xWxu1PKjhEmNYNli5lrRK17M:BR69dGngMZr/XxHfO0xWxugjhEMrR
TLSH
T13EE47B217A86087AD066C139D381A163E634B1C70F62BDFF53990134AF8DFDA5B78E16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4844	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6036	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4844	powershell.exe
4844	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4844	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3208 wrote to memory of 4844	3208	2026-08-05_b37c253a305d879ca66b5b0251ec8c0e_akira_cobalt-strike_rusty-stealer_satacom.exe	89
PID 4844 wrote to memory of 6036	4844	powershell.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-05_b37c253a305d879ca66b5b0251ec8c0e_akira_cobalt-strike_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_b37c253a305d879ca66b5b0251ec8c0e_akira_cobalt-strike_rusty-stealer_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -command "Unblock-File -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\runtime_YFZ9f56ShnWZzJIAC.bat' -ErrorAction SilentlyContinue; Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\runtime_YFZ9f56ShnWZzJIAC.bat' -ArgumentList 'silent' -WindowStyle Hidden"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\runtime_YFZ9f56ShnWZzJIAC.bat" silent "
    3⤵
    - Executes a command shell one-liner
    PID:6036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

runtime_YFZ9f56ShnWZzJIAC.bat

Path C:\Users\Admin\AppData\Local\Temp\runtime_YFZ9f56ShnWZzJIAC.bat
Size 320KB
SHA256 98ae06567b9c033a5ba3228fa131b05f83b27168dabefb726bd922bdb7cf2803
MD5 7774908e3bc2105484a7833e9fec7104
SHA1 f58c3fe7fae056322cdb72fb89db1286712c8e0d
SHA512 090e7c22937868cf8588ca4f271fd77912b6c42314e42cfcdee015351efdd74f7fa86c32d0ac6cfa10e0f629e43de2b558db52ca38ee91f1413db1d4c3df9eaa
SSDEEP 6144:BmaxQitjBlJvXydVME0A6Wl/uOqPKjhE4JDl7PBCNlaNf5lrA:BXxzzfmT0xWxu1PKjhEmNYNli5lrA
TLSH
T18564AF64FAC60C5AAAF7225BF4D2C547F778C2D3093550CEA1EF0248834F989A6F651B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4844-10-0x00007FFBA68D0000-0x00007FFBA7274000-memory.dmp

Download

memory/4844-6-0x00007FFBA68D0000-0x00007FFBA7274000-memory.dmp

Download

memory/4844-7-0x00007FFBA68D0000-0x00007FFBA7274000-memory.dmp

Download

memory/4844-8-0x00007FFBA68D0000-0x00007FFBA7274000-memory.dmp

Download

memory/4844-9-0x00007FFBA68D0000-0x00007FFBA7274000-memory.dmp

Download

memory/4844-2-0x00007FFBA6A5F000-0x00007FFBA6A60000-memory.dmp

Download

memory/4844-11-0x00007FFBA68D0000-0x00007FFBA7274000-memory.dmp

Download

memory/4844-12-0x00007FFBA68D0000-0x00007FFBA7274000-memory.dmp

Download

memory/4844-13-0x00007FFBA68D0000-0x00007FFBA7274000-memory.dmp

Download

memory/4844-5-0x0000021549A80000-0x0000021549AA2000-memory.dmp

Download

memory/4844-17-0x00007FFBA68D0000-0x00007FFBA7274000-memory.dmp

Download

memory/4844-16-0x00007FFBA68D0000-0x00007FFBA7274000-memory.dmp

Download