Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/09/2026, 10:47
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-09-04_521e3cffdbe2b4e9739e77f302622bef_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-04_521e3cffdbe2b4e9739e77f302622bef_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-09-04_521e3cffdbe2b4e9739e77f302622bef_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe
- Size 3.6MB
- Sample260905-mvsctasfpf
- SHA256 1a0933b61a8744529a2f40e0253bf2fb8797135ff5d73b8c5558234a25e13d97
- MD5 521e3cffdbe2b4e9739e77f302622bef
- SHA1 091b2cd93081b352f60bde4071596ab22b47b21a
- SHA512 848733ee295f24e6b6fc2721ad9f05ea143aa6c67fafb089baf22bf274c7345f4944f9b688eec5d6dd6a2d545a85bbf854724e8a3f8b659b458d61b5a4d83ef1
- SSDEEP 49152:RUKJ2JgPG/HsF4lHNGltlOBnTnQlnOSo6hOuJI7ukzdNvjMLYLIHoSIGD8T0KtqM:RfNo4noo1oFd5tqaZ
- TLSH T1F5067B03F79985E9C09EC178C3565323EB76B8891B20B39F26E44A213F57B611F6E394
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Discovers running processes 1 TTPs 2 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 3984 tasklist.exe 1492 tasklist.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4184 wmic.exe Token: SeSecurityPrivilege 4184 wmic.exe Token: SeTakeOwnershipPrivilege 4184 wmic.exe Token: SeLoadDriverPrivilege 4184 wmic.exe Token: SeSystemProfilePrivilege 4184 wmic.exe Token: SeSystemtimePrivilege 4184 wmic.exe Token: SeProfSingleProcessPrivilege 4184 wmic.exe Token: SeIncBasePriorityPrivilege 4184 wmic.exe Token: SeCreatePagefilePrivilege 4184 wmic.exe Token: SeBackupPrivilege 4184 wmic.exe Token: SeRestorePrivilege 4184 wmic.exe Token: SeShutdownPrivilege 4184 wmic.exe Token: SeDebugPrivilege 4184 wmic.exe Token: SeSystemEnvironmentPrivilege 4184 wmic.exe Token: SeRemoteShutdownPrivilege 4184 wmic.exe Token: SeUndockPrivilege 4184 wmic.exe Token: SeManageVolumePrivilege 4184 wmic.exe Token: 33 4184 wmic.exe Token: 34 4184 wmic.exe Token: 35 4184 wmic.exe Token: 36 4184 wmic.exe Token: SeIncreaseQuotaPrivilege 4184 wmic.exe Token: SeSecurityPrivilege 4184 wmic.exe Token: SeTakeOwnershipPrivilege 4184 wmic.exe Token: SeLoadDriverPrivilege 4184 wmic.exe Token: SeSystemProfilePrivilege 4184 wmic.exe Token: SeSystemtimePrivilege 4184 wmic.exe Token: SeProfSingleProcessPrivilege 4184 wmic.exe Token: SeIncBasePriorityPrivilege 4184 wmic.exe Token: SeCreatePagefilePrivilege 4184 wmic.exe Token: SeBackupPrivilege 4184 wmic.exe Token: SeRestorePrivilege 4184 wmic.exe Token: SeShutdownPrivilege 4184 wmic.exe Token: SeDebugPrivilege 4184 wmic.exe Token: SeSystemEnvironmentPrivilege 4184 wmic.exe Token: SeRemoteShutdownPrivilege 4184 wmic.exe Token: SeUndockPrivilege 4184 wmic.exe Token: SeManageVolumePrivilege 4184 wmic.exe Token: 33 4184 wmic.exe Token: 34 4184 wmic.exe Token: 35 4184 wmic.exe Token: 36 4184 wmic.exe Token: SeDebugPrivilege 3984 tasklist.exe Token: SeIncreaseQuotaPrivilege 3272 wmic.exe Token: SeSecurityPrivilege 3272 wmic.exe Token: SeTakeOwnershipPrivilege 3272 wmic.exe Token: SeLoadDriverPrivilege 3272 wmic.exe Token: SeSystemProfilePrivilege 3272 wmic.exe Token: SeSystemtimePrivilege 3272 wmic.exe Token: SeProfSingleProcessPrivilege 3272 wmic.exe Token: SeIncBasePriorityPrivilege 3272 wmic.exe Token: SeCreatePagefilePrivilege 3272 wmic.exe Token: SeBackupPrivilege 3272 wmic.exe Token: SeRestorePrivilege 3272 wmic.exe Token: SeShutdownPrivilege 3272 wmic.exe Token: SeDebugPrivilege 3272 wmic.exe Token: SeSystemEnvironmentPrivilege 3272 wmic.exe Token: SeRemoteShutdownPrivilege 3272 wmic.exe Token: SeUndockPrivilege 3272 wmic.exe Token: SeManageVolumePrivilege 3272 wmic.exe Token: 33 3272 wmic.exe Token: 34 3272 wmic.exe Token: 35 3272 wmic.exe Token: 36 3272 wmic.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2796 wrote to memory of 4184 2796 2026-09-04_521e3cffdbe2b4e9739e77f302622bef_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe 86 PID 2796 wrote to memory of 3984 2796 2026-09-04_521e3cffdbe2b4e9739e77f302622bef_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe 88 PID 2796 wrote to memory of 3272 2796 2026-09-04_521e3cffdbe2b4e9739e77f302622bef_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe 89 PID 2796 wrote to memory of 3780 2796 2026-09-04_521e3cffdbe2b4e9739e77f302622bef_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe 90 PID 2796 wrote to memory of 968 2796 2026-09-04_521e3cffdbe2b4e9739e77f302622bef_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe 102 PID 2796 wrote to memory of 1492 2796 2026-09-04_521e3cffdbe2b4e9739e77f302622bef_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe 103 PID 2796 wrote to memory of 3164 2796 2026-09-04_521e3cffdbe2b4e9739e77f302622bef_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe 104 PID 2796 wrote to memory of 1904 2796 2026-09-04_521e3cffdbe2b4e9739e77f302622bef_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-04_521e3cffdbe2b4e9739e77f302622bef_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-04_521e3cffdbe2b4e9739e77f302622bef_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\System32\Wbem\wmic.exe"wmic" nic where NetEnabled=true get MACAddress2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4184
-
-
C:\Windows\system32\tasklist.exe"tasklist"2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
PID:3984
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" ComputerSystem get Model2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3272
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" ComputerSystem get TotalPhysicalMemory2⤵PID:3780
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" nic where NetEnabled=true get MACAddress2⤵PID:968
-
-
C:\Windows\system32\tasklist.exe"tasklist"2⤵
- Discovers running processes
PID:1492
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" ComputerSystem get Model2⤵PID:3164
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" ComputerSystem get TotalPhysicalMemory2⤵PID:1904
-