Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/08/2026, 15:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
28 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
28 signatures
150 seconds
General
- Target 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
- Size 2.7MB
- Sample260816-sg2l8aeb43
- SHA256 0c0c9908d3803c6c1bc4cc3318a6b3463f95b6b233c9f34ede873e204c45799e
- MD5 21eee3466d196d257fb96ced61fc9446
- SHA1 6945d3838c6b8c0c97e17d42bb3b310e0ed5a2e3
- SHA512 2c2e96290c2cb3f53751fc418b31c0bbd4a660c3fd5be08ef258592cb19359b136cd23cd0f873ae881df045437a50940466733f12d1037db659c17fdad4f7166
- SSDEEP 49152:s2e2RfOsG+ujHESRxRR/AWQKv9eukyV2hdnw:E0lsjH+Kv4ukW
- TLSH T171D5C011DB460DA7C11A85388176472AC3663C860ED1C7E792E82C77FFC61D86ABD2DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" timeout.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" timeout.exe - Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" timeout.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" timeout.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" timeout.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" timeout.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection timeout.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" timeout.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" timeout.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" timeout.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection timeout.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" timeout.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe - Windows security bypass 2 TTPs 14 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ = "0" timeout.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\svchost.exe = "0" 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\unregmp2.exe = "0" 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft = "0" timeout.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths timeout.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft = "0" timeout.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ = "0" timeout.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\\ = "0" 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\D:\\ = "0" 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions\exe = "0" 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions\dll = "0" 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions\sys = "0" 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths timeout.exe - Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 2 IoCs
resource yara_rule behavioral1/memory/1764-18-0x00000238DF300000-0x00000238DF359000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/1764-41-0x00000238DF300000-0x00000238DF359000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs - Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
resource yara_rule behavioral1/memory/1764-18-0x00000238DF300000-0x00000238DF359000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral1/files/0x000200000001e973-10.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Enumerates VirtualBox registry keys 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe - Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe - Looks for VMWare services registry key. 1 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmtools 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe - Modify Registry: Disable Windows Driver Blocklist 2 TTPs 1 IoCs
Disable Windows Driver Blocklist via Registry.
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable = "0" 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe - Executes dropped EXE 4 IoCs
pid Process 2400 585D.tmp 1764 timeout.exe 1844 AppProfileSvc.exe 2736 timeout.exe - Loads dropped DLL 4 IoCs
pid Process 1764 timeout.exe 1764 timeout.exe 2736 timeout.exe 2736 timeout.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Windows security modification 2 TTPs 15 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft = "0" timeout.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ = "0" timeout.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft = "0" timeout.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ = "0" timeout.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\\ = "0" 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\D:\\ = "0" 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths timeout.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions\sys = "0" 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths timeout.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\svchost.exe = "0" 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\unregmp2.exe = "0" 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions\exe = "0" 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions\dll = "0" 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftAppVerifier = "C:\\ProgramData\\Microsoft\\MicrosoftAppVerifier\\timeout.exe /t 68546 /nobreak" timeout.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Modifies Security services 2 TTPs 2 IoCs
Modifies the startup behavior of a security service.
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdFilter\Start = "4" 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv\Start = "4" 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2240 cmd.exe - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2240 cmd.exe 2424 PING.EXE - Delays execution with timeout.exe 2 IoCs
pid Process 1764 timeout.exe 2736 timeout.exe - Kills process with taskkill 19 IoCs
pid Process 4992 taskkill.exe 1688 taskkill.exe 308 taskkill.exe 1784 taskkill.exe 4624 taskkill.exe 1500 taskkill.exe 2240 taskkill.exe 3488 taskkill.exe 4988 taskkill.exe 1080 taskkill.exe 4204 taskkill.exe 3960 taskkill.exe 3200 taskkill.exe 4812 taskkill.exe 684 taskkill.exe 2168 taskkill.exe 4212 taskkill.exe 4500 taskkill.exe 4316 taskkill.exe - Runs ping.exe 1 TTPs 1 IoCs
pid Process 2424 PING.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2372 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 2372 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 2372 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 2372 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 2372 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 2372 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe 1764 timeout.exe - Suspicious behavior: LoadsDriver 4 IoCs
pid Process 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found - Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeDebugPrivilege 4212 taskkill.exe Token: SeDebugPrivilege 2240 taskkill.exe Token: SeDebugPrivilege 1688 taskkill.exe Token: SeDebugPrivilege 3960 taskkill.exe Token: SeDebugPrivilege 308 taskkill.exe Token: SeDebugPrivilege 3200 taskkill.exe Token: SeDebugPrivilege 3488 taskkill.exe Token: SeDebugPrivilege 4812 taskkill.exe Token: SeDebugPrivilege 4988 taskkill.exe Token: SeDebugPrivilege 1784 taskkill.exe Token: SeDebugPrivilege 4624 taskkill.exe Token: SeDebugPrivilege 684 taskkill.exe Token: SeDebugPrivilege 4992 taskkill.exe Token: SeDebugPrivilege 1080 taskkill.exe Token: SeDebugPrivilege 4204 taskkill.exe Token: SeDebugPrivilege 4500 taskkill.exe Token: SeDebugPrivilege 4316 taskkill.exe Token: SeDebugPrivilege 2168 taskkill.exe Token: SeDebugPrivilege 1500 taskkill.exe - Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 2372 wrote to memory of 4212 2372 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 92 PID 2372 wrote to memory of 2240 2372 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 95 PID 2372 wrote to memory of 1688 2372 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 97 PID 2372 wrote to memory of 3960 2372 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 99 PID 2372 wrote to memory of 308 2372 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 101 PID 2372 wrote to memory of 3200 2372 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 103 PID 2372 wrote to memory of 3488 2372 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 105 PID 2372 wrote to memory of 4812 2372 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 107 PID 2372 wrote to memory of 4988 2372 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 109 PID 2372 wrote to memory of 1784 2372 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 111 PID 2372 wrote to memory of 4624 2372 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 113 PID 2372 wrote to memory of 684 2372 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 115 PID 2372 wrote to memory of 4992 2372 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 117 PID 2372 wrote to memory of 1080 2372 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 119 PID 2372 wrote to memory of 4204 2372 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 121 PID 2372 wrote to memory of 4500 2372 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 123 PID 2372 wrote to memory of 4316 2372 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 125 PID 2372 wrote to memory of 2168 2372 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 127 PID 2372 wrote to memory of 1500 2372 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 129 PID 2372 wrote to memory of 1764 2372 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 132 PID 2372 wrote to memory of 2240 2372 2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 134 PID 2240 wrote to memory of 2424 2240 cmd.exe 136 PID 1844 wrote to memory of 2736 1844 AppProfileSvc.exe 142
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"1⤵
- Modifies security service
- Windows security bypass
- Enumerates VirtualBox registry keys
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Modify Registry: Disable Windows Driver Blocklist
- Windows security modification
- Modifies Security services
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\system32\taskkill.exe"taskkill" /F /IM MsMpEng.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4212
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM MpCmdRun.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2240
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM NisSrv.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1688
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM SecurityHealthService.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3960
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM SecurityHealthSystray.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:308
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM smartscreen.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3200
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM SgrmBroker.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3488
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM HipsTray.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4812
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM wsctrl.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4988
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM usysdiag.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1784
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM HipsDaemon.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4624
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM QQPCTray.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:684
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM QQPCRTP.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4992
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM QQPCMgr.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1080
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM 360Tray.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4204
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM 360Safe.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4500
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM ZhuDongFangYu.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4316
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM avp.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2168
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM ekrn.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1500
-
-
C:\ProgramData\Microsoft\MicrosoftAppVerifier\timeout.exe"C:\ProgramData\Microsoft\MicrosoftAppVerifier\timeout.exe" /t 68546 /nobreak2⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Delays execution with timeout.exe
- Suspicious behavior: EnumeratesProcesses
PID:1764
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c ping 127.0.0.1 -n 3 >nul & del /f /q "C:\Users\Admin\AppData\Local\Temp\2026-08-16_21eee3466d196d257fb96ced61fc9446_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe" & exit2⤵
- Executes a command shell one-liner
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 33⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2424
-
-
-
C:\Users\Admin\AppData\Local\Temp\585D.tmpC:\Users\Admin\AppData\Local\Temp\585D.tmp1⤵
- Executes dropped EXE
PID:2400
-
C:\ProgramData\Microsoft\MicrosoftAppVerifier\AppProfileSvc.exeC:\ProgramData\Microsoft\MicrosoftAppVerifier\AppProfileSvc.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\ProgramData\Microsoft\MicrosoftAppVerifier\timeout.exeC:\ProgramData\Microsoft\MicrosoftAppVerifier\timeout.exe /t 68546 /nobreak2⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Delays execution with timeout.exe
PID:2736
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Defense Evasion
Impair Defenses
6Disable or Modify Tools
4Modify Registry
8Virtualization/Sandbox Evasion
3Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Microsoft\MicrosoftAppVerifier\AppProfileSvc.exe
- Size 193KB
- SHA256 539bd47cffaba7cc593dc1457ab73a0c2c33586c1e9c4e81bab3512ae4ab242d
- MD5 6c1ee9d78090f1cb4574bca3f01449ee
- SHA1 40de03ed64c4b7a84c077a2b884eda6d19325a06
- SHA512 61bfb611625fb02679b1b05e207263e5146b47879e440885f3095f20343e1d6f7ee3be6ed2bf556395de806d66de353939acf7a9d66c67321bfdb29a53876a9b
- SSDEEP 3072:uDiGPjxZqpARXuPCPfbmtr7b4UUwg8lhSbHpbqvcC/I9SzJGP3:+7qpAJuBHb4UFhwJbLCPg3
- TLSH T156147C12B79550F8E067C078C6514A52A77674860B21ABFF03B44339AF667E6BF3CB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\MicrosoftAppVerifier\VERSION.dll
- Size 14KB
- SHA256 546999e933575e3cda9ba4e5d26be8bea0844e68ac366145fa5b3a634b9c1650
- MD5 89fd2230b6cec10de67fdf9dca6f42b0
- SHA1 1f04bbdb5e019b8908e3d2d087e95a187720a1b3
- SHA512 f541fe71ffdb62366c07ab7f7bbdd1354d00db6ba90f48e5f93a2ee28fc1a26c2dd6510ae465cfa83ef220258fcf520297516f53fde88a2a28cc9b54357c5477
- SSDEEP 384:45CX3Oi9UCoPaDjpZ4hmcVPxIiTsyOEPW8khWo:NO8DpehmcVPxIiTsy3FkR
- TLSH T1FE622B0666650079E4A783FB9AB31D2237FC724084F6F85E12E4905D2DF3A052A67BCE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\MicrosoftAppVerifier\cache.db
- Size 329KB
- SHA256 80632d303a90fdaa05a4168c0a8875b35d8ca0921d2404e98d881ab62f9a448f
- MD5 72bcab02e47b1950288187c304843f26
- SHA1 0c18929893e03e6aaaab8efec301e9a0a87a02c9
- SHA512 d6abfef9454f059baadea35926bf0c48c7bb93b63ae0970cb047c3bce8aaecaad03cc0286656c96c16d7bd87806c0483b94402feaaa2b9e7cc373e9deca3d9af
- SSDEEP 6144:VpeWU/cmQPiytxy3EOWTKxzTj8/UQdu/GRcjES8ei+ulQP08NfXlYPU:SmmANOMuj88yhRKEStIlLQVYs
- TLSH T11274E068D7A05E7E2F275EEDD14E0CDF564B99A316C6012627F0DBE5CA202E0840FE6D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\MicrosoftAppVerifier\metrics.bin
- Size 382KB
- SHA256 1d022ee0cd186ac818d78d28bbcec644af4a47ad4cf470be97166700095e2f45
- MD5 cf1f1517b2077374024465cf089855f4
- SHA1 9d0ca73394487dcb9060a4e229282c21a13e354c
- SHA512 262319ff7e206f9de1b28342482001c96a39c62ba1cc83b1eccd7474162132edbf2b673769e4187f9f350401befd8422fe29df6df1b7d6947b43b3adc2557c31
- SSDEEP 6144:z29SnijL8cxC9Y9fs1rfSdLoI6Oz1POUQEtSNIKKrcNsBIRpWcniW7+iqWsW7h4J:a9Yi0cxCa9fOTePXSNIKccAIRpWcnD7q
- TLSH T18084E12DC368C014150F2476B00E121E6B4EA8E213E901F7E7FDA7FA35EA66056F9776
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\MicrosoftAppVerifier\mfc140u_a1079568.dll
- Size 382KB
- SHA256 bc6da57ee9bb1a2467acf8b8ecc2ad2b227f81f1b54b7c6f327fc87af2aad7f5
- MD5 74dff1ba0b61dba794963d7f8885af79
- SHA1 e64e65cc7c7994f3f85ea8ab08366351c2425ad7
- SHA512 35403caf742f2c15906f85b8cdb9b72f6208dc738de02457d84f7e1472357bca5559766fe5272d996d1374fd407d2fb9435c20f5e7d598a7c015699370553d24
- SSDEEP 6144:kg6ZFToRiXjdBQeuHjAKprpLImpzKPekjfQy1dJF6rH/GLIAfrpY1YwmveMES/UD:k5FTldBQeuHMKpNL1BKWk7F7JF6jGLI7
- TLSH T11184D005F69949BED93786B8C09B0596EB7BB99B06C5D21F07F047E10F623C4812EF1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\MicrosoftAppVerifier\timeout.exe
- Size 56KB
- SHA256 106490870753d87d0c5a1b4fe83045a06518d415ec595bd1d0c30fe3ed4149c1
- MD5 39417af218ca9916633d4d9c979dc443
- SHA1 0d7077cd7516abe34da8af05cad61e84afb756a5
- SHA512 f1e4fa01793f3e6148be764fc802dadd587e2d24c7df64ab5b1eeb3baa967e618748bb67cb775314a48d8fe98b769271c901948ec21c51800d1cb605ca9860ab
- SSDEEP 768:d9S/frK5u9ViA9ZlxHTsCHt2XHVcHf31KAV6xrc/vBOvF:dOuw9jfAaIcHflN6xE2F
- TLSH T1CB43081D62A430F8E466927CC595031AD235B53237A153FF13F4C7366B23ADAA63AE41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\585D.tmp
- Size 18KB
- SHA256 5685465b413f512a45a8645a2f45ad2fe4c6e479308a536c90a2d7e6048ba128
- MD5 85f89e206b386433759b7e9a648f460b
- SHA1 1008f51ff5c9217fb19d8c9ba26c8cb44b5b4328
- SHA512 0e3a2481504042506e0fc4b8a56bab5f646faf195c866bc0ecfa30fa31ea2fe225ddb4f72ff432d831afea8772a1ff719a03f73edfe9ce0eea9115a48cef0802
- SSDEEP 384:IAZeRSx08gp2JY8cHZg2KxnYPLQa6jjqoneMh:IdrkuXHZg2KxymD
- TLSH T16F824C9B4A2510E3DDEAC674C186E177FC70B2512FB851CB94B485862E96BE02F3D30E
- MD5 SHA1 SHA512 SSDEEP TLSH