6e6afb4cbcb63171359f9b0f4375e9bc41bf29189c18f52789e445e4bcb6c52a

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/10/2026, 12:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-02_55cc9ad26162ae6ac7fcde4e9285b918_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Size 1.6MB
Sample261003-pl2agada95
SHA256 6e6afb4cbcb63171359f9b0f4375e9bc41bf29189c18f52789e445e4bcb6c52a
MD5 55cc9ad26162ae6ac7fcde4e9285b918
SHA1 60dd8b3cd2aa278e0e4d95bbc491e7158b3051ce
SHA512 d64c28e853079eeeec0987dc778cf8e67049ac8325995f801fa08daf9038570e0869b0a95d8a0eaeb703fb71570fd835dd3fa35a4207d3a2b22c797811bdfbdb
SSDEEP 24576:2Y9sj5KkX4Gy+4f7aCvUT739+LHK8mm9U/HPo78UsENMnEj:2Y9sjskXjym73ErK8mCUef2E
TLSH
T184757D47F56680EDC17DC131875A6126BB35784D47283EEB3BDC42217F62BE06A3AB09
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-02_55cc9ad26162ae6ac7fcde4e9285b918_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-02_55cc9ad26162ae6ac7fcde4e9285b918_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-10-02_55cc9ad26162ae6ac7fcde4e9285b918_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-10-02_55cc9ad26162ae6ac7fcde4e9285b918_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-02_55cc9ad26162ae6ac7fcde4e9285b918_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-02_55cc9ad26162ae6ac7fcde4e9285b918_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
PID:3616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads