fae1a9aa44c1ce223d6d5811646db4b25763a6a2f860d30d77f12e73f0b1935f

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/08/2026, 01:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_0a020eafe2fcc18d0d0540dc376180f5_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe
Size 4.2MB
Sample260815-cdnceswhpg
SHA256 fae1a9aa44c1ce223d6d5811646db4b25763a6a2f860d30d77f12e73f0b1935f
MD5 0a020eafe2fcc18d0d0540dc376180f5
SHA1 f48b8f690a3eba83a8bae7bc8de97554fcd26960
SHA512 3abd520ed8ba8936488d757f540ddf9e90caf2f272d13da4bd6700dc7ef4ae058986d3772e3262abce622ae49041414c52606f04c1ae31b1da9b4aa6db693cf3
SSDEEP 49152:7p8SKq9QLJTb/MTAAojBgbNAbXxOvSzOhrqOliujlsEsqqWegh4pw5JX9+dcIvyy:F8g9qAi+fqWn9LIKcIKJT+oBB
TLSH
T1EF2629117B8A94ADC06AC474834A46729A3134CB1B35B9FF45C892793FBAAF45F3C718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1796	Client.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
5024	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5024	taskkill.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 5024	1036	2026-08-15_0a020eafe2fcc18d0d0540dc376180f5_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe	85
PID 1036 wrote to memory of 1796	1036	2026-08-15_0a020eafe2fcc18d0d0540dc376180f5_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-15_0a020eafe2fcc18d0d0540dc376180f5_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_0a020eafe2fcc18d0d0540dc376180f5_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM Client.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5024
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Executes dropped EXE
  PID:1796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

Client.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Size 3.8MB
SHA256 604d294f05a22c944006c4eb01aefd85c743c1a661727d18dd632e9e50a0ebc5
MD5 fe06a8d2dc56850192e553b0e7b2af15
SHA1 30f40c179ea13ca924e6c336b5fa48033eb7d91e
SHA512 a6fc4aa7d5344dccfc08fce5a1996b76a2eaec87ffdc23406d06a161be3a7a2edf2ac75b5802e31177d94b132e9dccc0d2bcbab3107fccb811801d7f5bc121bb
SSDEEP 49152:3LJTb/MTAAojBgbNAbXxOvSzOhrqOliujlsEsqqWegh4pw5JX9+dcIvy7apIgh9D:K9qAi+fqWn9LIKcIKJT+oB
TLSH
T17A0618117B8A94ADC0AAC474834A46725A3134CB1F35B9FF45C892793EB9AF46F3C718
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca.pem

Path C:\Users\Admin\AppData\Roaming\SubDir\ca.pem
Size 602B
SHA256 f815ca1b775ed2582fabf343982d1930d1399f322a8a21211660c10c9d479606
MD5 2f20bbf70348608bac9fbbe7842b0292
SHA1 9171be93ade0df9980466fd412393d21c7047ddd
SHA512 cf62483114c9f91dfde8481b2d3dba0e6f1e86a67f859378288aecf0bb3de265171e0cfd6e7d222701a1e4218da14bdfac22c4827d7079eaf9f48735b2932595
TLSH
T1AAF041FA1E2AAD1324C48192EF4F4238C425A9D26847995C0A8F04089F4BFDE343E21E
MD5 SHA1 SHA512 TLSH

Submit Download

client.key.pem

Path C:\Users\Admin\AppData\Roaming\SubDir\client.key.pem
Size 246B
SHA256 a62d12a06544c0d4aa66b74a9e61cdb8a226464952d4a72e8a3beb6fca64ff04
MD5 dff5311d69079ce3f8e40eb363793b85
SHA1 da399af37a1d912fc9edd89641e3ba2f2bd0b399
SHA512 a9bf9ecc9452f7338f9a2febb6e9bf18a0bafa2424ca6adaa11adc719a533e321631c75a958742b38c5f8077e364d35f3c92d31d425946f525a3deb0efdc67e5
TLSH
T152D095AA2D4DDDE040D1D1650C01133F71AEC7F1412787D5C78E04973D04FF1609C554
MD5 SHA1 SHA512 TLSH

Submit Download

client.pem

Path C:\Users\Admin\AppData\Roaming\SubDir\client.pem
Size 606B
SHA256 e87ee35b68922a312075a56b5e3ca101d2bd074cba98ecc7bc82f2084c90606d
MD5 55152192d46b168781c94af9b8070331
SHA1 8f80c3ebab483dd6670cbd3f52f0ad864baf1852
SHA512 aae95ded0f3bddbd65932eac93375d0e0bf9bfcb8f4f0b866487552b41897e74f43e3d9158e5f76befc1e811e231d93c837beaf919386d1da4a959665ac0fd3e
TLSH
T148F002F51F220C2024BAC0D2CE1B096D4437BAE26483C908258E01255347569307EE0C
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads