Overview

overview

6

Static

static

3

2026-08-09...om.exe

windows10-2004-x64

6

2026-08-09...om.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    150s
  • max time network
    113s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/08/2026, 11:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-09_0f8e3672307d726baa7eb1dfdb8b3ecc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
  • Size 3.6MB
  • Sample260809-ncffzadr9z
  • SHA256 a8bff2438de535da728e8ae25edcbe78819627a9b68c48e7016afd36d958d42c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Looks up external IP address via web service 1 TTPs 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Using powershell.exe command.

    execution
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • cURL User-Agent 1 IoCs

    Uses User-Agent string associated with cURL utility.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_0f8e3672307d726baa7eb1dfdb8b3ecc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_0f8e3672307d726baa7eb1dfdb8b3ecc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4860
    • C:\Windows\System32\Wbem\wmic.exe
      "wmic" process get name,commandline
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4852
    • C:\Windows\system32\getmac.exe
      "getmac"
      2⤵
        PID:2912
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic" bios get manufacturer
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1824
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic" computersystem get model
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2704
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic" diskdrive get model
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:4868
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command "(Get-WmiObject Win32_Processor).ProcessorId"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:2176
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command "(Get-WmiObject Win32_BaseBoard).SerialNumber"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:108
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command "(Get-WmiObject Win32_PhysicalMedia | Where-Object {$_.SerialNumber -ne $null} | Select-Object -First 1).SerialNumber"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:624
      • C:\Windows\system32\curl.exe
        "curl" -s --max-time 5 https://api.ipify.org
        2⤵
          PID:3712
        • C:\Windows\system32\curl.exe
          "curl" -s --max-time 5 https://icanhazip.com
          2⤵
            PID:716
          • C:\Windows\system32\ipconfig.exe
            "ipconfig" /all
            2⤵
            • Gathers network information
            PID:6036
          • C:\Windows\system32\netsh.exe
            "netsh" wlan show profiles
            2⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Network Configuration Discovery: Wi-Fi Discovery
            PID:6024
          • C:\Windows\System32\Wbem\wmic.exe
            "wmic" /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:3388
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command "Get-MpComputerStatus | Select-Object -ExpandProperty RealTimeProtectionEnabled"
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:3200
          • C:\Windows\System32\Wbem\wmic.exe
            "wmic" computersystem get partofdomain
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:4304
          • C:\Windows\System32\Wbem\wmic.exe
            "wmic" computersystem get domain
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:6040
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe"
            2⤵
              PID:4124

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 54aa570220e696de49a9a588711123e43032522c4578b6fa4f918d2666c1cb32
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 5e34248dd2cc55f37525b0f9dd7f4f19e879ad15905df49539c20497a21dd7ec
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                __PSScriptPolicyTest_fa0teuug.t2o.ps1
                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fa0teuug.t2o.ps1
                • Size 60B
                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                memory/2176-0-0x000001FFB4BA0000-0x000001FFB4BC2000-memory.dmp
                Download

                memory/3200-17-0x000001E270C60000-0x000001E270C7E000-memory.dmp
                Download

                memory/3200-18-0x000001E270F90000-0x000001E271042000-memory.dmp
                Download

                memory/3200-19-0x000001E270C80000-0x000001E270C8A000-memory.dmp
                Download