Overview

overview

6

Static

static

1

2026-08-19...om.exe

windows10-2004-x64

6

2026-08-19...om.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    150s
  • max time network
    113s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    19/08/2026, 04:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-19_bb6d053f6203307c6b88a2092fbab76b_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe
  • Size 25.2MB
  • Sample260819-e6vcjsdn6t
  • SHA256 cdb016bb6ed612e9c679057e1dafebed1494e50e1774c40f4f2745246444772d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasionexecution

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Using powershell.exe command.

    execution
  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-19_bb6d053f6203307c6b88a2092fbab76b_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-19_bb6d053f6203307c6b88a2092fbab76b_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5768
    • C:\Users\Admin\AppData\Local\Temp\2026-08-19_bb6d053f6203307c6b88a2092fbab76b_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-19_bb6d053f6203307c6b88a2092fbab76b_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe" --no-dashboard serve --host 127.0.0.1 --port 8787
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2416
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -Command "Get-CimInstance Win32_VideoController | Select-Object Name,AdapterRAM | ForEach-Object { $_.Name + '|' + $_.AdapterRAM }"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2776
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -Command "Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\*' -ErrorAction SilentlyContinue | ForEach-Object { $d = $_.DriverDesc; $m = $_.'HardwareInformation.qwMemorySize'; if ($null -eq $m) { $m = $_.'HardwareInformation.MemorySize' }; if ($m -is [byte[]]) { if ($m.Length -ge 8) { $m = [System.BitConverter]::ToUInt64($m, 0) } elseif ($m.Length -ge 4) { $m = [System.BitConverter]::ToUInt32($m, 0) } else { $m = $null } } elseif ($m -is [int] -and $m -lt 0) { $m = [long]$m + 4294967296 }; if ($d -and $m) { $d + '|' + $m } }"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Hide Artifacts: Ignore Process Interrupts
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5176
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -Command "Get-CimInstance Win32_VideoController | Select-Object Name,AdapterRAM | ForEach-Object { $_.Name + '|' + $_.AdapterRAM }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3096
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -Command "Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\*' -ErrorAction SilentlyContinue | ForEach-Object { $d = $_.DriverDesc; $m = $_.'HardwareInformation.qwMemorySize'; if ($null -eq $m) { $m = $_.'HardwareInformation.MemorySize' }; if ($m -is [byte[]]) { if ($m.Length -ge 8) { $m = [System.BitConverter]::ToUInt64($m, 0) } elseif ($m.Length -ge 4) { $m = [System.BitConverter]::ToUInt32($m, 0) } else { $m = $null } } elseif ($m -is [int] -and $m -lt 0) { $m = [long]$m + 4294967296 }; if ($d -and $m) { $d + '|' + $m } }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Hide Artifacts: Ignore Process Interrupts
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5040
    • C:\Windows\system32\curl.exe
      "curl" -sf --max-time 2 http://localhost:8080/health
      2⤵
        PID:5504

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 7d5423fab0bc688fe408ae455cf60ad90cd6398b0ebb0c5a535b34f8e429bcb9
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 0a5f9cc514e19aaa28bae4f2f071840dac5f9b85472b55deec2b756ad176c96a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 6dae3746bf6ea78a84d1aea5347418095ee7128d666733d2a233d695dc9afb4f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          __PSScriptPolicyTest_wev3tozt.jj5.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wev3tozt.jj5.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/2776-3-0x000001B2C4260000-0x000001B2C4282000-memory.dmp
          Download

          memory/2776-6-0x000001B2C42E0000-0x000001B2C42FE000-memory.dmp
          Download

          memory/2776-7-0x000001B2DC460000-0x000001B2DC512000-memory.dmp
          Download

          memory/2776-8-0x000001B2C4300000-0x000001B2C430A000-memory.dmp
          Download

          memory/2776-9-0x000001B2DC520000-0x000001B2DC54A000-memory.dmp
          Download

          memory/2776-10-0x000001B2DC520000-0x000001B2DC544000-memory.dmp
          Download