Analysis
- max time kernel
150s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/09/2026, 10:47
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-09-04_521e3cffdbe2b4e9739e77f302622bef_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-04_521e3cffdbe2b4e9739e77f302622bef_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-09-04_521e3cffdbe2b4e9739e77f302622bef_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe
- Size 3.6MB
- Sample260905-mvsctasfpf
- SHA256 1a0933b61a8744529a2f40e0253bf2fb8797135ff5d73b8c5558234a25e13d97
- MD5 521e3cffdbe2b4e9739e77f302622bef
- SHA1 091b2cd93081b352f60bde4071596ab22b47b21a
- SHA512 848733ee295f24e6b6fc2721ad9f05ea143aa6c67fafb089baf22bf274c7345f4944f9b688eec5d6dd6a2d545a85bbf854724e8a3f8b659b458d61b5a4d83ef1
- SSDEEP 49152:RUKJ2JgPG/HsF4lHNGltlOBnTnQlnOSo6hOuJI7ukzdNvjMLYLIHoSIGD8T0KtqM:RfNo4noo1oFd5tqaZ
- TLSH T1F5067B03F79985E9C09EC178C3565323EB76B8891B20B39F26E44A213F57B611F6E394
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Discovers running processes 1 TTPs 2 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 4864 tasklist.exe 4288 tasklist.exe - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 240 wmic.exe 240 wmic.exe 240 wmic.exe 240 wmic.exe 5876 wmic.exe 5876 wmic.exe 5876 wmic.exe 5876 wmic.exe 4028 wmic.exe 4028 wmic.exe 4028 wmic.exe 4028 wmic.exe 5304 wmic.exe 5304 wmic.exe 5304 wmic.exe 5304 wmic.exe 2976 wmic.exe 2976 wmic.exe 2976 wmic.exe 2976 wmic.exe 5080 wmic.exe 5080 wmic.exe 5080 wmic.exe 5080 wmic.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 240 wmic.exe Token: SeSecurityPrivilege 240 wmic.exe Token: SeTakeOwnershipPrivilege 240 wmic.exe Token: SeLoadDriverPrivilege 240 wmic.exe Token: SeSystemProfilePrivilege 240 wmic.exe Token: SeSystemtimePrivilege 240 wmic.exe Token: SeProfSingleProcessPrivilege 240 wmic.exe Token: SeIncBasePriorityPrivilege 240 wmic.exe Token: SeCreatePagefilePrivilege 240 wmic.exe Token: SeBackupPrivilege 240 wmic.exe Token: SeRestorePrivilege 240 wmic.exe Token: SeShutdownPrivilege 240 wmic.exe Token: SeDebugPrivilege 240 wmic.exe Token: SeSystemEnvironmentPrivilege 240 wmic.exe Token: SeRemoteShutdownPrivilege 240 wmic.exe Token: SeUndockPrivilege 240 wmic.exe Token: SeManageVolumePrivilege 240 wmic.exe Token: 33 240 wmic.exe Token: 34 240 wmic.exe Token: 35 240 wmic.exe Token: 36 240 wmic.exe Token: SeIncreaseQuotaPrivilege 240 wmic.exe Token: SeSecurityPrivilege 240 wmic.exe Token: SeTakeOwnershipPrivilege 240 wmic.exe Token: SeLoadDriverPrivilege 240 wmic.exe Token: SeSystemProfilePrivilege 240 wmic.exe Token: SeSystemtimePrivilege 240 wmic.exe Token: SeProfSingleProcessPrivilege 240 wmic.exe Token: SeIncBasePriorityPrivilege 240 wmic.exe Token: SeCreatePagefilePrivilege 240 wmic.exe Token: SeBackupPrivilege 240 wmic.exe Token: SeRestorePrivilege 240 wmic.exe Token: SeShutdownPrivilege 240 wmic.exe Token: SeDebugPrivilege 240 wmic.exe Token: SeSystemEnvironmentPrivilege 240 wmic.exe Token: SeRemoteShutdownPrivilege 240 wmic.exe Token: SeUndockPrivilege 240 wmic.exe Token: SeManageVolumePrivilege 240 wmic.exe Token: 33 240 wmic.exe Token: 34 240 wmic.exe Token: 35 240 wmic.exe Token: 36 240 wmic.exe Token: SeDebugPrivilege 4288 tasklist.exe Token: SeIncreaseQuotaPrivilege 5876 wmic.exe Token: SeSecurityPrivilege 5876 wmic.exe Token: SeTakeOwnershipPrivilege 5876 wmic.exe Token: SeLoadDriverPrivilege 5876 wmic.exe Token: SeSystemProfilePrivilege 5876 wmic.exe Token: SeSystemtimePrivilege 5876 wmic.exe Token: SeProfSingleProcessPrivilege 5876 wmic.exe Token: SeIncBasePriorityPrivilege 5876 wmic.exe Token: SeCreatePagefilePrivilege 5876 wmic.exe Token: SeBackupPrivilege 5876 wmic.exe Token: SeRestorePrivilege 5876 wmic.exe Token: SeShutdownPrivilege 5876 wmic.exe Token: SeDebugPrivilege 5876 wmic.exe Token: SeSystemEnvironmentPrivilege 5876 wmic.exe Token: SeRemoteShutdownPrivilege 5876 wmic.exe Token: SeUndockPrivilege 5876 wmic.exe Token: SeManageVolumePrivilege 5876 wmic.exe Token: 33 5876 wmic.exe Token: 34 5876 wmic.exe Token: 35 5876 wmic.exe Token: 36 5876 wmic.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 256 wrote to memory of 240 256 2026-09-04_521e3cffdbe2b4e9739e77f302622bef_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe 89 PID 256 wrote to memory of 4288 256 2026-09-04_521e3cffdbe2b4e9739e77f302622bef_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe 91 PID 256 wrote to memory of 5876 256 2026-09-04_521e3cffdbe2b4e9739e77f302622bef_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe 92 PID 256 wrote to memory of 4028 256 2026-09-04_521e3cffdbe2b4e9739e77f302622bef_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe 93 PID 256 wrote to memory of 5304 256 2026-09-04_521e3cffdbe2b4e9739e77f302622bef_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe 95 PID 256 wrote to memory of 4864 256 2026-09-04_521e3cffdbe2b4e9739e77f302622bef_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe 97 PID 256 wrote to memory of 2976 256 2026-09-04_521e3cffdbe2b4e9739e77f302622bef_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe 98 PID 256 wrote to memory of 5080 256 2026-09-04_521e3cffdbe2b4e9739e77f302622bef_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-04_521e3cffdbe2b4e9739e77f302622bef_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-04_521e3cffdbe2b4e9739e77f302622bef_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:256 -
C:\Windows\System32\Wbem\wmic.exe"wmic" nic where NetEnabled=true get MACAddress2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:240
-
-
C:\Windows\system32\tasklist.exe"tasklist"2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
PID:4288
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" ComputerSystem get Model2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5876
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" ComputerSystem get TotalPhysicalMemory2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4028
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" nic where NetEnabled=true get MACAddress2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5304
-
-
C:\Windows\system32\tasklist.exe"tasklist"2⤵
- Discovers running processes
PID:4864
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" ComputerSystem get Model2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2976
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" ComputerSystem get TotalPhysicalMemory2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5080
-