4516cd85e4b6c46de9a64642f6b3027a62a6bce98d20ee0ec153033f65c81e30

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/10/2026, 17:19

Target
2026-09-30_259018f6c3a2e5e7948a37e560b5614d_akira_cobalt-strike_rusty-stealer_satacom.exe
Size 104KB
Sample261001-vv9absha63
SHA256 4516cd85e4b6c46de9a64642f6b3027a62a6bce98d20ee0ec153033f65c81e30
MD5 259018f6c3a2e5e7948a37e560b5614d
SHA1 10489d74f5939bf93c25adbf971cfa0b8dd3431b
SHA512 de895d3bc4dc0e6b31d51ea6cc71d14db922aa39d4d41d0c607afaa1217c6ff81f199ab76d8cf241d5bf4a4fc9d576be83bbf8f77302615d8b718a3debb2e6a1
SSDEEP 1536:Ri49rjjECqOu6OT7R0UXxBqsML4re+RAi69heQJh8ZZCq4Di9FvZX8FJC:RiOYS0T7RtPqzQjRmhXaZZe29f8rC
TLSH
T10FA35D17B64195FCF019C07CC3158673A776B0E50B22ABFF12B851382F69AE62F39A15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4620 wrote to memory of 3304	4620	2026-09-30_259018f6c3a2e5e7948a37e560b5614d_akira_cobalt-strike_rusty-stealer_satacom.exe	90
PID 4620 wrote to memory of 3304	4620	2026-09-30_259018f6c3a2e5e7948a37e560b5614d_akira_cobalt-strike_rusty-stealer_satacom.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-09-30_259018f6c3a2e5e7948a37e560b5614d_akira_cobalt-strike_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_259018f6c3a2e5e7948a37e560b5614d_akira_cobalt-strike_rusty-stealer_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe
  2⤵
  PID:3304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1132