640910d706afc757b7dcfa40c6508451584a850cef0db1dc6eecfcda6a43f43e

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/08/2026, 06:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_e9d66281130d3db0bee9e2dabdfcb494_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
Size 595KB
Sample260827-grrdfszdmg
SHA256 640910d706afc757b7dcfa40c6508451584a850cef0db1dc6eecfcda6a43f43e
MD5 e9d66281130d3db0bee9e2dabdfcb494
SHA1 25b93371bcac58b8539f56312d8c38969fdd0a45
SHA512 d98199c6ad167c2e71d262aca712e652cd70798642284a8b839d7723c63a6261047c70e10cb9db96665426b375862acdd8211c9ac5bd67decf6809e2bb9371d7
SSDEEP 12288:59o5rFBcfNB9k2CEAiKq/N+MbTj2tj3HFxTPfz:59MxBcjCEkq/N++ebHrf
TLSH
T128D4720556258688D197B8FE01352B5BEFB1BC024B068FAF3FF55A466F0C1A4EA673C1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

execution persistence

Malware Config

Signatures

Detects executables packed with ConfuserEx Mod 1 IoCs

resource	yara_rule
behavioral1/memory/4036-13-0x000002BF5FF00000-0x000002BF5FF24000-memory.dmp	INDICATOR_EXE_Packed_ConfuserEx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2026-08-27_e9d66281130d3db0bee9e2dabdfcb494_akira_cobalt-strike_icedid_rusty-stealer_satacom = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-27_e9d66281130d3db0bee9e2dabdfcb494_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2026-08-27_e9d66281130d3db0bee9e2dabdfcb494_akira_cobalt-strike_icedid_rusty-stealer_satacom = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-27_e9d66281130d3db0bee9e2dabdfcb494_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3844	powershell.exe
3512	powershell.exe

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral1/memory/4036-13-0x000002BF5FF00000-0x000002BF5FF24000-memory.dmp	ConfuserEx

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3512	powershell.exe
3512	powershell.exe
3844	powershell.exe
3844	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3512	powershell.exe
Token: SeDebugPrivilege	3844	powershell.exe
Token: SeDebugPrivilege	4036	2026-08-27_e9d66281130d3db0bee9e2dabdfcb494_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
Token: SeDebugPrivilege	4008	2026-08-27_e9d66281130d3db0bee9e2dabdfcb494_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4036 wrote to memory of 4840	4036	2026-08-27_e9d66281130d3db0bee9e2dabdfcb494_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	87
PID 4840 wrote to memory of 3512	4840	conhost.exe	88
PID 4008 wrote to memory of 1764	4008	2026-08-27_e9d66281130d3db0bee9e2dabdfcb494_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	91
PID 1764 wrote to memory of 3844	1764	conhost.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-08-27_e9d66281130d3db0bee9e2dabdfcb494_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_e9d66281130d3db0bee9e2dabdfcb494_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4036
- C:\Windows\SYSTEM32\conhost.exe
  conhost.exe --headless powershell.exe -NonInteractive -Command "New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name '2026-08-27_e9d66281130d3db0bee9e2dabdfcb494_akira_cobalt-strike_icedid_rusty-stealer_satacom' -Value 'C:\Users\Admin\AppData\Local\Temp\2026-08-27_e9d66281130d3db0bee9e2dabdfcb494_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe' -PropertyType String -Force"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NonInteractive -Command "New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name '2026-08-27_e9d66281130d3db0bee9e2dabdfcb494_akira_cobalt-strike_icedid_rusty-stealer_satacom' -Value 'C:\Users\Admin\AppData\Local\Temp\2026-08-27_e9d66281130d3db0bee9e2dabdfcb494_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe' -PropertyType String -Force"
    3⤵
    - Adds Run key to start application
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3512

C:\Users\Admin\AppData\Local\Temp\2026-08-27_e9d66281130d3db0bee9e2dabdfcb494_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
C:\Users\Admin\AppData\Local\Temp\2026-08-27_e9d66281130d3db0bee9e2dabdfcb494_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4008
- C:\Windows\system32\conhost.exe
  conhost.exe --headless powershell.exe -NonInteractive -Command "New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name '2026-08-27_e9d66281130d3db0bee9e2dabdfcb494_akira_cobalt-strike_icedid_rusty-stealer_satacom' -Value 'C:\Users\Admin\AppData\Local\Temp\2026-08-27_e9d66281130d3db0bee9e2dabdfcb494_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe' -PropertyType String -Force"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1764
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NonInteractive -Command "New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name '2026-08-27_e9d66281130d3db0bee9e2dabdfcb494_akira_cobalt-strike_icedid_rusty-stealer_satacom' -Value 'C:\Users\Admin\AppData\Local\Temp\2026-08-27_e9d66281130d3db0bee9e2dabdfcb494_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe' -PropertyType String -Force"
    3⤵
    - Adds Run key to start application
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
TLSH
T148510F323375F1E4C8567F071E68198053BF4395EA94AF5CB298621ED92741B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 787628c3dd129679416857bcb63c52f8477a02cfeadfe0d4d5d98eb7902c61d8
MD5 40588a42cb8549ecc094e7d45f28c74c
SHA1 65d5d1f79fe82009c3c4c6d2c7ce874939926b8b
SHA512 e77dd348027e9df604520e228061f2e9c3d87ad695567c81dd95976eaba7df580eb565bff8b485558a0561bdd0de6ac202ead1965f6c23f746e5542ff9bea3c6
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_wfrhkk5d.kdy.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wfrhkk5d.kdy.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3512-1-0x00000152FE810000-0x00000152FE820000-memory.dmp

Download

memory/3512-9-0x00000152E6170000-0x00000152E6192000-memory.dmp

Download

memory/3512-0-0x00000152FE810000-0x00000152FE820000-memory.dmp

Download

memory/4036-13-0x000002BF5FF00000-0x000002BF5FF24000-memory.dmp

Download

memory/4036-15-0x000002BF78830000-0x000002BF78840000-memory.dmp

Download

memory/4036-14-0x000002BF78830000-0x000002BF78840000-memory.dmp

Download

memory/4036-12-0x000002BF78830000-0x000002BF78840000-memory.dmp

Download

memory/4036-27-0x000002BF78830000-0x000002BF78840000-memory.dmp

Download

memory/4036-29-0x000002BF78830000-0x000002BF78840000-memory.dmp

Download

memory/4036-28-0x000002BF78830000-0x000002BF78840000-memory.dmp

Download