Analysis
- max time kernel
150s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/09/2026, 01:45
General
- Target 2026-09-08_f1457ff53f3c68cd3dcebf380a4c5495_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
- Size 8.5MB
- Sample260910-b6lhvsv1cy
- SHA256 f45438c0995228c1f0d8885e7ff7d991aeed55c77d27fbe449bcd4d3b2048168
Malware Config
Signatures
- Looks for VirtualBox drivers on disk 2 TTPs 3 IoCs
- Looks for VMWare drivers on disk 2 TTPs 1 IoCs
- Uses browser remote debugging 2 TTPs 1 IoCs
Can be used to control the browser and steal sensitive information such as credentials and session cookies.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-08_f1457ff53f3c68cd3dcebf380a4c5495_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-08_f1457ff53f3c68cd3dcebf380a4c5495_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"1⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --disable-gpu --disable-logging --log-level=3 --silent-debug-dump --disable-background-networking --disable-sync --disable-default-apps --disable-features=PushMessaging,NotificationTriggers --remote-debugging-port=0 --no-first-run --no-default-browser-check --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\acc18d3d2546bee9b88_p"2⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
acc18d3d2546bee9b88.json
n0.log
n0.log
inj_debug.txt
payload_trace.txt
memory/2764-101-0x000001E84D8D0000-0x000001E84D8D1000-memory.dmp
memory/2764-103-0x000001E84D8F0000-0x000001E84D8F1000-memory.dmp
memory/2764-102-0x000001E84D8E0000-0x000001E84D8E1000-memory.dmp
memory/2764-78-0x000001E84C0D0000-0x000001E84C0D1000-memory.dmp
memory/2764-100-0x000001E84D8C0000-0x000001E84D8C1000-memory.dmp
memory/2764-98-0x000001E84C0F0000-0x000001E84C0F1000-memory.dmp
memory/2764-99-0x000001E84C100000-0x000001E84C101000-memory.dmp
memory/2764-109-0x000001E84D900000-0x000001E84D901000-memory.dmp
memory/2764-77-0x000001E84C0C0000-0x000001E84C0C1000-memory.dmp
memory/2764-79-0x000001E84C0E0000-0x000001E84C0E1000-memory.dmp
memory/2764-127-0x000001E84D910000-0x000001E84D911000-memory.dmp