Analysis
- max time kernel
164s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/09/2026, 03:27
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-09-08_af8e4d3c0173a859ded83eeb10ef9b37_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-08_af8e4d3c0173a859ded83eeb10ef9b37_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-09-08_af8e4d3c0173a859ded83eeb10ef9b37_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe
- Size 3.6MB
- Sample260910-dzz4sawble
- SHA256 ccdd567b3d33b0234eacc034a532112272ec0fdce9fc792ee7ce0b8aef449c93
- MD5 af8e4d3c0173a859ded83eeb10ef9b37
- SHA1 d3f60aa22a8ea8caf2ebb09ef6e39679ab4053b4
- SHA512 3aa74fa05ae0f0962e244c0d24827b33a04fc3b619be75428755e3c7caf729ba92fe3b7215ea75a8dba95a534b16821071ca77825ac8819a352678f7f27b8828
- SSDEEP 49152:8WKJ2JgPG/HsF4lHNGltlOBnTnQlnOSo6hOuJI7ukzdNvjMLYLIHoSIGQ8T0KtqA:81No4noo1oFdCtqNO
- TLSH T1D0067B03F79985E9C09EC178C3565323EB76B8891B20B39F26E44A213F57B611F6E394
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Discovers running processes 1 TTPs 2 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 1984 tasklist.exe 2768 tasklist.exe - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 5760 wmic.exe 5760 wmic.exe 5760 wmic.exe 5760 wmic.exe 4564 wmic.exe 4564 wmic.exe 4564 wmic.exe 4564 wmic.exe 3956 wmic.exe 3956 wmic.exe 3956 wmic.exe 3956 wmic.exe 5340 wmic.exe 5340 wmic.exe 5340 wmic.exe 5340 wmic.exe 5496 wmic.exe 5496 wmic.exe 5496 wmic.exe 5496 wmic.exe 3724 wmic.exe 3724 wmic.exe 3724 wmic.exe 3724 wmic.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 5760 wmic.exe Token: SeSecurityPrivilege 5760 wmic.exe Token: SeTakeOwnershipPrivilege 5760 wmic.exe Token: SeLoadDriverPrivilege 5760 wmic.exe Token: SeSystemProfilePrivilege 5760 wmic.exe Token: SeSystemtimePrivilege 5760 wmic.exe Token: SeProfSingleProcessPrivilege 5760 wmic.exe Token: SeIncBasePriorityPrivilege 5760 wmic.exe Token: SeCreatePagefilePrivilege 5760 wmic.exe Token: SeBackupPrivilege 5760 wmic.exe Token: SeRestorePrivilege 5760 wmic.exe Token: SeShutdownPrivilege 5760 wmic.exe Token: SeDebugPrivilege 5760 wmic.exe Token: SeSystemEnvironmentPrivilege 5760 wmic.exe Token: SeRemoteShutdownPrivilege 5760 wmic.exe Token: SeUndockPrivilege 5760 wmic.exe Token: SeManageVolumePrivilege 5760 wmic.exe Token: 33 5760 wmic.exe Token: 34 5760 wmic.exe Token: 35 5760 wmic.exe Token: 36 5760 wmic.exe Token: SeIncreaseQuotaPrivilege 5760 wmic.exe Token: SeSecurityPrivilege 5760 wmic.exe Token: SeTakeOwnershipPrivilege 5760 wmic.exe Token: SeLoadDriverPrivilege 5760 wmic.exe Token: SeSystemProfilePrivilege 5760 wmic.exe Token: SeSystemtimePrivilege 5760 wmic.exe Token: SeProfSingleProcessPrivilege 5760 wmic.exe Token: SeIncBasePriorityPrivilege 5760 wmic.exe Token: SeCreatePagefilePrivilege 5760 wmic.exe Token: SeBackupPrivilege 5760 wmic.exe Token: SeRestorePrivilege 5760 wmic.exe Token: SeShutdownPrivilege 5760 wmic.exe Token: SeDebugPrivilege 5760 wmic.exe Token: SeSystemEnvironmentPrivilege 5760 wmic.exe Token: SeRemoteShutdownPrivilege 5760 wmic.exe Token: SeUndockPrivilege 5760 wmic.exe Token: SeManageVolumePrivilege 5760 wmic.exe Token: 33 5760 wmic.exe Token: 34 5760 wmic.exe Token: 35 5760 wmic.exe Token: 36 5760 wmic.exe Token: SeDebugPrivilege 1984 tasklist.exe Token: SeIncreaseQuotaPrivilege 4564 wmic.exe Token: SeSecurityPrivilege 4564 wmic.exe Token: SeTakeOwnershipPrivilege 4564 wmic.exe Token: SeLoadDriverPrivilege 4564 wmic.exe Token: SeSystemProfilePrivilege 4564 wmic.exe Token: SeSystemtimePrivilege 4564 wmic.exe Token: SeProfSingleProcessPrivilege 4564 wmic.exe Token: SeIncBasePriorityPrivilege 4564 wmic.exe Token: SeCreatePagefilePrivilege 4564 wmic.exe Token: SeBackupPrivilege 4564 wmic.exe Token: SeRestorePrivilege 4564 wmic.exe Token: SeShutdownPrivilege 4564 wmic.exe Token: SeDebugPrivilege 4564 wmic.exe Token: SeSystemEnvironmentPrivilege 4564 wmic.exe Token: SeRemoteShutdownPrivilege 4564 wmic.exe Token: SeUndockPrivilege 4564 wmic.exe Token: SeManageVolumePrivilege 4564 wmic.exe Token: 33 4564 wmic.exe Token: 34 4564 wmic.exe Token: 35 4564 wmic.exe Token: 36 4564 wmic.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 6140 wrote to memory of 5760 6140 2026-09-08_af8e4d3c0173a859ded83eeb10ef9b37_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe 90 PID 6140 wrote to memory of 1984 6140 2026-09-08_af8e4d3c0173a859ded83eeb10ef9b37_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe 92 PID 6140 wrote to memory of 4564 6140 2026-09-08_af8e4d3c0173a859ded83eeb10ef9b37_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe 93 PID 6140 wrote to memory of 3956 6140 2026-09-08_af8e4d3c0173a859ded83eeb10ef9b37_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe 94 PID 6140 wrote to memory of 5340 6140 2026-09-08_af8e4d3c0173a859ded83eeb10ef9b37_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe 96 PID 6140 wrote to memory of 2768 6140 2026-09-08_af8e4d3c0173a859ded83eeb10ef9b37_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe 97 PID 6140 wrote to memory of 5496 6140 2026-09-08_af8e4d3c0173a859ded83eeb10ef9b37_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe 98 PID 6140 wrote to memory of 3724 6140 2026-09-08_af8e4d3c0173a859ded83eeb10ef9b37_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-08_af8e4d3c0173a859ded83eeb10ef9b37_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-08_af8e4d3c0173a859ded83eeb10ef9b37_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\Windows\System32\Wbem\wmic.exe"wmic" nic where NetEnabled=true get MACAddress2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5760
-
-
C:\Windows\system32\tasklist.exe"tasklist"2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
PID:1984
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" ComputerSystem get Model2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4564
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" ComputerSystem get TotalPhysicalMemory2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3956
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" nic where NetEnabled=true get MACAddress2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5340
-
-
C:\Windows\system32\tasklist.exe"tasklist"2⤵
- Discovers running processes
PID:2768
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" ComputerSystem get Model2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5496
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" ComputerSystem get TotalPhysicalMemory2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3724
-