Overview

overview

6

Static

static

1

2026-08-19...om.exe

windows10-2004-x64

6

2026-08-19...om.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    19/08/2026, 04:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-19_bb6d053f6203307c6b88a2092fbab76b_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe
  • Size 25.2MB
  • Sample260819-e6vcjsdn6t
  • SHA256 cdb016bb6ed612e9c679057e1dafebed1494e50e1774c40f4f2745246444772d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasionexecution

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Using powershell.exe command.

    execution
  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-19_bb6d053f6203307c6b88a2092fbab76b_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-19_bb6d053f6203307c6b88a2092fbab76b_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4892
    • C:\Users\Admin\AppData\Local\Temp\2026-08-19_bb6d053f6203307c6b88a2092fbab76b_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-19_bb6d053f6203307c6b88a2092fbab76b_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe" --no-dashboard serve --host 127.0.0.1 --port 8787
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4484
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -Command "Get-CimInstance Win32_VideoController | Select-Object Name,AdapterRAM | ForEach-Object { $_.Name + '|' + $_.AdapterRAM }"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:972
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -Command "Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\*' -ErrorAction SilentlyContinue | ForEach-Object { $d = $_.DriverDesc; $m = $_.'HardwareInformation.qwMemorySize'; if ($null -eq $m) { $m = $_.'HardwareInformation.MemorySize' }; if ($m -is [byte[]]) { if ($m.Length -ge 8) { $m = [System.BitConverter]::ToUInt64($m, 0) } elseif ($m.Length -ge 4) { $m = [System.BitConverter]::ToUInt32($m, 0) } else { $m = $null } } elseif ($m -is [int] -and $m -lt 0) { $m = [long]$m + 4294967296 }; if ($d -and $m) { $d + '|' + $m } }"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Hide Artifacts: Ignore Process Interrupts
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3508
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -Command "Get-CimInstance Win32_VideoController | Select-Object Name,AdapterRAM | ForEach-Object { $_.Name + '|' + $_.AdapterRAM }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:548
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -Command "Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\*' -ErrorAction SilentlyContinue | ForEach-Object { $d = $_.DriverDesc; $m = $_.'HardwareInformation.qwMemorySize'; if ($null -eq $m) { $m = $_.'HardwareInformation.MemorySize' }; if ($m -is [byte[]]) { if ($m.Length -ge 8) { $m = [System.BitConverter]::ToUInt64($m, 0) } elseif ($m.Length -ge 4) { $m = [System.BitConverter]::ToUInt32($m, 0) } else { $m = $null } } elseif ($m -is [int] -and $m -lt 0) { $m = [long]$m + 4294967296 }; if ($d -and $m) { $d + '|' + $m } }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Hide Artifacts: Ignore Process Interrupts
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3136
    • C:\Windows\system32\curl.exe
      "curl" -sf --max-time 2 http://localhost:8080/health
      2⤵
        PID:2832

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          powershell.exe.log
          • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
          • Size 3KB
          • SHA256 8ea23cace0fc8387c3befda7e57552c93506d08258a27c5d82afcbb31b75d4a5
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 3e7f1ca8766c5cce194988b68dbe1f1b8ba8ead5c0f1ab8a4cdef7e1b42a41f6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 bdcd72119d17292be73660288ea70b4e5be6d4b5a5a9e19812deef5e6062949b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 45ef846a7fabb3e57203580f88b320bd5c5232100cc07d989291106ebae5405d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          __PSScriptPolicyTest_pjjhjc2w.gfw.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pjjhjc2w.gfw.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/972-2-0x00000202A62D0000-0x00000202A62E0000-memory.dmp
          Download

          memory/972-1-0x00000202A62D0000-0x00000202A62E0000-memory.dmp
          Download

          memory/972-10-0x00000202A85C0000-0x00000202A85E2000-memory.dmp
          Download

          memory/972-11-0x00000202A8620000-0x00000202A864A000-memory.dmp
          Download

          memory/972-12-0x00000202A8620000-0x00000202A8644000-memory.dmp
          Download