ca7b1294eb6bb6e9e9980a6f855fbce1f388bd4bbb923e8fbfffffa4fdce2be1

Analysis

max time kernel
150s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 09:28

Target
2026-08-20_e4e9a1b7fb066e6468c666f0b36f46c1_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
Size 12.2MB
Sample260820-lfbabace32
SHA256 ca7b1294eb6bb6e9e9980a6f855fbce1f388bd4bbb923e8fbfffffa4fdce2be1
MD5 e4e9a1b7fb066e6468c666f0b36f46c1
SHA1 7a46f336aa26a45df5df55b7ff300a30e2660083
SHA512 fa6f506f4e3258854bfc85f493ff52b9398f17367c5093ee9ba831d64b7638d192aac2455cbfea7cffb8b1607c25a6fd15b709f6b94c3ba1badd40adf6c277d9
SSDEEP 393216:g/uAe8PA1uVWp+RXc7wSE+LoHJyMn05Hia:gWWA1uWp+mMSpoHJyW05C
TLSH
T195D6330269DE2CF9E416C87482528A1299597C9F1732EDFF03C842365F6ABF52F353A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 4136	4892	2026-08-20_e4e9a1b7fb066e6468c666f0b36f46c1_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	90
PID 4892 wrote to memory of 4456	4892	2026-08-20_e4e9a1b7fb066e6468c666f0b36f46c1_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	91
PID 4892 wrote to memory of 6024	4892	2026-08-20_e4e9a1b7fb066e6468c666f0b36f46c1_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-08-20_e4e9a1b7fb066e6468c666f0b36f46c1_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_e4e9a1b7fb066e6468c666f0b36f46c1_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Windows\system32\reg.exe
  "reg" query HKCU\Software\Valve\Steam /v SteamPath
  2⤵
  - Modifies registry key
  PID:4136
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SOFTWARE\WOW6432Node\Valve\Steam /v InstallPath
  2⤵
  - Modifies registry key
  PID:4456
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SOFTWARE\Valve\Steam /v InstallPath
  2⤵
  - Modifies registry key
  PID:6024

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact