Analysis
- max time kernel
149s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/09/2026, 03:27
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-09-08_af8e4d3c0173a859ded83eeb10ef9b37_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-08_af8e4d3c0173a859ded83eeb10ef9b37_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-09-08_af8e4d3c0173a859ded83eeb10ef9b37_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe
- Size 3.6MB
- Sample260910-dzz4sawble
- SHA256 ccdd567b3d33b0234eacc034a532112272ec0fdce9fc792ee7ce0b8aef449c93
- MD5 af8e4d3c0173a859ded83eeb10ef9b37
- SHA1 d3f60aa22a8ea8caf2ebb09ef6e39679ab4053b4
- SHA512 3aa74fa05ae0f0962e244c0d24827b33a04fc3b619be75428755e3c7caf729ba92fe3b7215ea75a8dba95a534b16821071ca77825ac8819a352678f7f27b8828
- SSDEEP 49152:8WKJ2JgPG/HsF4lHNGltlOBnTnQlnOSo6hOuJI7ukzdNvjMLYLIHoSIGQ8T0KtqA:81No4noo1oFdCtqNO
- TLSH T1D0067B03F79985E9C09EC178C3565323EB76B8891B20B39F26E44A213F57B611F6E394
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Discovers running processes 1 TTPs 2 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 2760 tasklist.exe 2596 tasklist.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1036 wmic.exe Token: SeSecurityPrivilege 1036 wmic.exe Token: SeTakeOwnershipPrivilege 1036 wmic.exe Token: SeLoadDriverPrivilege 1036 wmic.exe Token: SeSystemProfilePrivilege 1036 wmic.exe Token: SeSystemtimePrivilege 1036 wmic.exe Token: SeProfSingleProcessPrivilege 1036 wmic.exe Token: SeIncBasePriorityPrivilege 1036 wmic.exe Token: SeCreatePagefilePrivilege 1036 wmic.exe Token: SeBackupPrivilege 1036 wmic.exe Token: SeRestorePrivilege 1036 wmic.exe Token: SeShutdownPrivilege 1036 wmic.exe Token: SeDebugPrivilege 1036 wmic.exe Token: SeSystemEnvironmentPrivilege 1036 wmic.exe Token: SeRemoteShutdownPrivilege 1036 wmic.exe Token: SeUndockPrivilege 1036 wmic.exe Token: SeManageVolumePrivilege 1036 wmic.exe Token: 33 1036 wmic.exe Token: 34 1036 wmic.exe Token: 35 1036 wmic.exe Token: 36 1036 wmic.exe Token: SeIncreaseQuotaPrivilege 1036 wmic.exe Token: SeSecurityPrivilege 1036 wmic.exe Token: SeTakeOwnershipPrivilege 1036 wmic.exe Token: SeLoadDriverPrivilege 1036 wmic.exe Token: SeSystemProfilePrivilege 1036 wmic.exe Token: SeSystemtimePrivilege 1036 wmic.exe Token: SeProfSingleProcessPrivilege 1036 wmic.exe Token: SeIncBasePriorityPrivilege 1036 wmic.exe Token: SeCreatePagefilePrivilege 1036 wmic.exe Token: SeBackupPrivilege 1036 wmic.exe Token: SeRestorePrivilege 1036 wmic.exe Token: SeShutdownPrivilege 1036 wmic.exe Token: SeDebugPrivilege 1036 wmic.exe Token: SeSystemEnvironmentPrivilege 1036 wmic.exe Token: SeRemoteShutdownPrivilege 1036 wmic.exe Token: SeUndockPrivilege 1036 wmic.exe Token: SeManageVolumePrivilege 1036 wmic.exe Token: 33 1036 wmic.exe Token: 34 1036 wmic.exe Token: 35 1036 wmic.exe Token: 36 1036 wmic.exe Token: SeDebugPrivilege 2760 tasklist.exe Token: SeIncreaseQuotaPrivilege 4488 wmic.exe Token: SeSecurityPrivilege 4488 wmic.exe Token: SeTakeOwnershipPrivilege 4488 wmic.exe Token: SeLoadDriverPrivilege 4488 wmic.exe Token: SeSystemProfilePrivilege 4488 wmic.exe Token: SeSystemtimePrivilege 4488 wmic.exe Token: SeProfSingleProcessPrivilege 4488 wmic.exe Token: SeIncBasePriorityPrivilege 4488 wmic.exe Token: SeCreatePagefilePrivilege 4488 wmic.exe Token: SeBackupPrivilege 4488 wmic.exe Token: SeRestorePrivilege 4488 wmic.exe Token: SeShutdownPrivilege 4488 wmic.exe Token: SeDebugPrivilege 4488 wmic.exe Token: SeSystemEnvironmentPrivilege 4488 wmic.exe Token: SeRemoteShutdownPrivilege 4488 wmic.exe Token: SeUndockPrivilege 4488 wmic.exe Token: SeManageVolumePrivilege 4488 wmic.exe Token: 33 4488 wmic.exe Token: 34 4488 wmic.exe Token: 35 4488 wmic.exe Token: 36 4488 wmic.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1284 wrote to memory of 1036 1284 2026-09-08_af8e4d3c0173a859ded83eeb10ef9b37_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe 85 PID 1284 wrote to memory of 2760 1284 2026-09-08_af8e4d3c0173a859ded83eeb10ef9b37_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe 87 PID 1284 wrote to memory of 4488 1284 2026-09-08_af8e4d3c0173a859ded83eeb10ef9b37_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe 88 PID 1284 wrote to memory of 4508 1284 2026-09-08_af8e4d3c0173a859ded83eeb10ef9b37_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe 89 PID 1284 wrote to memory of 3016 1284 2026-09-08_af8e4d3c0173a859ded83eeb10ef9b37_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe 98 PID 1284 wrote to memory of 2596 1284 2026-09-08_af8e4d3c0173a859ded83eeb10ef9b37_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe 99 PID 1284 wrote to memory of 1504 1284 2026-09-08_af8e4d3c0173a859ded83eeb10ef9b37_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe 100 PID 1284 wrote to memory of 2024 1284 2026-09-08_af8e4d3c0173a859ded83eeb10ef9b37_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-08_af8e4d3c0173a859ded83eeb10ef9b37_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-08_af8e4d3c0173a859ded83eeb10ef9b37_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\System32\Wbem\wmic.exe"wmic" nic where NetEnabled=true get MACAddress2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1036
-
-
C:\Windows\system32\tasklist.exe"tasklist"2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
PID:2760
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" ComputerSystem get Model2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4488
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" ComputerSystem get TotalPhysicalMemory2⤵PID:4508
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" nic where NetEnabled=true get MACAddress2⤵PID:3016
-
-
C:\Windows\system32\tasklist.exe"tasklist"2⤵
- Discovers running processes
PID:2596
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" ComputerSystem get Model2⤵PID:1504
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" ComputerSystem get TotalPhysicalMemory2⤵PID:2024
-