Overview

overview

3

Static

static

3

2026-10-14...om.exe

windows10-2004-x64

3

2026-10-14...om.exe

windows11-ltsc_2024-x64

3

Analysis

  • max time kernel
    151s
  • max time network
    137s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    14/10/2026, 12:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-14_c22a3099dedd7081f6953be475936f6d_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe
  • Size 25.6MB
  • Sample261014-py1vgads7x
  • SHA256 a836bed95a3c865f6acb28121c742b339206fe365866ae4f9fe192c053e7c911
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
execution

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs
  • cURL User-Agent 24 IoCs

    Uses User-Agent string associated with cURL utility.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-14_c22a3099dedd7081f6953be475936f6d_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-14_c22a3099dedd7081f6953be475936f6d_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:6132
    • C:\Users\Admin\AppData\Local\Temp\2026-10-14_c22a3099dedd7081f6953be475936f6d_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-10-14_c22a3099dedd7081f6953be475936f6d_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe" server
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3324
      • C:\Windows\system32\conhost.exe
        \\?\C:\Windows\system32\conhost.exe --headless --inheritcursor --width 119 --height 40 --signal 0x264 --server 0x25c
        3⤵
          PID:4884
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoExit -Command "if ($null -eq $global:__HerdrOriginalPrompt) { $global:__HerdrOriginalPrompt = $function:prompt; function global:prompt { $out = @(& $global:__HerdrOriginalPrompt) -join ' '; $loc = $ExecutionContext.SessionState.Path.CurrentLocation; if ($loc.Provider.Name -eq 'FileSystem') { try { [Environment]::CurrentDirectory = $loc.ProviderPath } catch {}; $esc = [string][char]27; $out += $esc + ']9;9;' + $loc.ProviderPath + $esc + '\' }; $out } }"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4240
        • C:\Windows\system32\curl.exe
          "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/index.toml
          3⤵
            PID:1740
          • C:\Windows\system32\curl.exe
            "curl" -sfL --retry 3 --connect-timeout 10 --max-time 20 https://herdr.dev/latest.json
            3⤵
              PID:4496
            • C:\Windows\system32\curl.exe
              "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/amp.toml
              3⤵
                PID:4116
              • C:\Windows\system32\curl.exe
                "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/antigravity.toml
                3⤵
                  PID:4352
                • C:\Windows\system32\curl.exe
                  "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/claude.toml
                  3⤵
                    PID:252
                  • C:\Windows\system32\curl.exe
                    "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/cline.toml
                    3⤵
                      PID:5708
                    • C:\Windows\system32\curl.exe
                      "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/codex.toml
                      3⤵
                        PID:5600
                      • C:\Windows\system32\curl.exe
                        "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/cursor.toml
                        3⤵
                          PID:3232
                        • C:\Windows\system32\curl.exe
                          "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/devin.toml
                          3⤵
                            PID:2552
                          • C:\Windows\system32\curl.exe
                            "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/droid.toml
                            3⤵
                              PID:4180
                            • C:\Windows\system32\curl.exe
                              "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/gemini.toml
                              3⤵
                                PID:5156
                              • C:\Windows\system32\curl.exe
                                "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/grok.toml
                                3⤵
                                  PID:3204
                                • C:\Windows\system32\curl.exe
                                  "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/hermes.toml
                                  3⤵
                                    PID:1112
                                  • C:\Windows\system32\curl.exe
                                    "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/kilo.toml
                                    3⤵
                                      PID:1832
                                    • C:\Windows\system32\curl.exe
                                      "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/kimi.toml
                                      3⤵
                                        PID:2524
                                      • C:\Windows\system32\curl.exe
                                        "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/kiro.toml
                                        3⤵
                                          PID:4872
                                        • C:\Windows\system32\curl.exe
                                          "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/letta.toml
                                          3⤵
                                            PID:908
                                          • C:\Windows\system32\curl.exe
                                            "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/maki.toml
                                            3⤵
                                              PID:4432
                                            • C:\Windows\system32\curl.exe
                                              "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/muse.toml
                                              3⤵
                                                PID:2548
                                              • C:\Windows\system32\curl.exe
                                                "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/opencode.toml
                                                3⤵
                                                  PID:4268
                                                • C:\Windows\system32\curl.exe
                                                  "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/pi.toml
                                                  3⤵
                                                    PID:1808
                                                  • C:\Windows\system32\curl.exe
                                                    "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/qodercli.toml
                                                    3⤵
                                                      PID:3272
                                                    • C:\Windows\system32\curl.exe
                                                      "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/qwen.toml
                                                      3⤵
                                                        PID:1388
                                                      • C:\Windows\system32\curl.exe
                                                        "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/github-copilot.toml
                                                        3⤵
                                                          PID:4528

                                                    Network

                                                          MITRE ATT&CK Enterprise v16

                                                          Replay Monitor

                                                          Loading Replay Monitor...

                                                          Downloads

                                                          agy.toml
                                                          • Path C:\Users\Admin\AppData\Local\herdr\agent-detection\remote\agy.toml
                                                          • Size 2KB
                                                          • SHA256 c25fc6bae935b7582d707120915287b52d39bf81b5ab3f368cd688739c6e0325
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          amp.toml
                                                          • Path C:\Users\Admin\AppData\Local\herdr\agent-detection\remote\amp.toml
                                                          • Size 1KB
                                                          • SHA256 b5806b0dd21e2f5e752d0eac7f084d5ce2e3f275638cfd1234c42cc88152dc8c
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          claude.toml
                                                          • Path C:\Users\Admin\AppData\Local\herdr\agent-detection\remote\claude.toml
                                                          • Size 7KB
                                                          • SHA256 e8b816a70edc1b5f91479acc9977f1f132a55b0c93845682611e91bdf8aa1920
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          cline.toml
                                                          • Path C:\Users\Admin\AppData\Local\herdr\agent-detection\remote\cline.toml
                                                          • Size 1KB
                                                          • SHA256 75fe33ec735c59638da8d62e16bddd257d9959e692edb83b1f11b7f28057866a
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          codex.toml
                                                          • Path C:\Users\Admin\AppData\Local\herdr\agent-detection\remote\codex.toml
                                                          • Size 4KB
                                                          • SHA256 d25cfddb5434259303fb0ac27b5b0e6d0558408e6901ee112bcd53de02bcda13
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          copilot.toml
                                                          • Path C:\Users\Admin\AppData\Local\herdr\agent-detection\remote\copilot.toml
                                                          • Size 1010B
                                                          • SHA256 b70c652584326a1a98475a5fcef16207dee9f23b65f8e78300f4fc2bb578cb11
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          cursor.toml
                                                          • Path C:\Users\Admin\AppData\Local\herdr\agent-detection\remote\cursor.toml
                                                          • Size 1KB
                                                          • SHA256 753b1f7f632d42fa21139c2767ecbb5e1078748aba2e59407ac4932d3ce36ad7
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          devin.toml
                                                          • Path C:\Users\Admin\AppData\Local\herdr\agent-detection\remote\devin.toml
                                                          • Size 1KB
                                                          • SHA256 250c9cea1d60bdb965dc6056f3066b785e941d60242756fbaca73b57ca6b0f85
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          droid.toml
                                                          • Path C:\Users\Admin\AppData\Local\herdr\agent-detection\remote\droid.toml
                                                          • Size 1KB
                                                          • SHA256 d37e7c464177c0e8f3edce8d4fabc4bcc7a1874edf2c4c87a2f927888cf69ce9
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          gemini.toml
                                                          • Path C:\Users\Admin\AppData\Local\herdr\agent-detection\remote\gemini.toml
                                                          • Size 700B
                                                          • SHA256 d7013b5e772852ecc595febf964f00b4f9edcbc6047a2a5421613a154d92520d
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          grok.toml
                                                          • Path C:\Users\Admin\AppData\Local\herdr\agent-detection\remote\grok.toml
                                                          • Size 4KB
                                                          • SHA256 8db7a8de4cd782fce26600859d78db7167399feb4c76f303104bc1bb83ab602b
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          hermes.toml
                                                          • Path C:\Users\Admin\AppData\Local\herdr\agent-detection\remote\hermes.toml
                                                          • Size 2KB
                                                          • SHA256 533d21b65dea3a0c60c25d0475c9c900d28a5712b6392669a7788f75de2b6e85
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          kilo.toml
                                                          • Path C:\Users\Admin\AppData\Local\herdr\agent-detection\remote\kilo.toml
                                                          • Size 694B
                                                          • SHA256 70f0ba4e58bc141fe69d7024013f973cd16e8616393079318914d70afeefef3b
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          kimi.toml
                                                          • Path C:\Users\Admin\AppData\Local\herdr\agent-detection\remote\kimi.toml
                                                          • Size 1KB
                                                          • SHA256 ede08c0d2d5024f7606dc0a1b2f7a9c6a0ebb99f3b6c58ca6757049856d06e05
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          kiro.toml
                                                          • Path C:\Users\Admin\AppData\Local\herdr\agent-detection\remote\kiro.toml
                                                          • Size 2KB
                                                          • SHA256 c8990f3c9d4810995be97e8df29836411e37d90f6ac9d9303f505787b504806b
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          letta.toml
                                                          • Path C:\Users\Admin\AppData\Local\herdr\agent-detection\remote\letta.toml
                                                          • Size 2KB
                                                          • SHA256 205b8c135584c86f9f529aa2d061109b5129085cc5c3124c6dbfe0e78fcdba43
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          maki.toml
                                                          • Path C:\Users\Admin\AppData\Local\herdr\agent-detection\remote\maki.toml
                                                          • Size 1KB
                                                          • SHA256 3b392170ee3082051266509f575a4640bde8d693b2f37ecf52157a641bc75b28
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          muse.toml
                                                          • Path C:\Users\Admin\AppData\Local\herdr\agent-detection\remote\muse.toml
                                                          • Size 3KB
                                                          • SHA256 b69c4d87fa9c19e3e6453b706fbe39c98a8b33ffbaa48e8cd5ae6751e9615074
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          opencode.toml
                                                          • Path C:\Users\Admin\AppData\Local\herdr\agent-detection\remote\opencode.toml
                                                          • Size 1008B
                                                          • SHA256 faa82aed2d76ad856528caae04232894594b74cc903aed3e522b3e725c5f2c95
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          pi.toml
                                                          • Path C:\Users\Admin\AppData\Local\herdr\agent-detection\remote\pi.toml
                                                          • Size 624B
                                                          • SHA256 949f5f3bcfeb6db1261432697dd94a9ed625a733d70c00e6fc0910372fad7c66
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          qodercli.toml
                                                          • Path C:\Users\Admin\AppData\Local\herdr\agent-detection\remote\qodercli.toml
                                                          • Size 1KB
                                                          • SHA256 2089f70fc78c6576fd7128a00f4e7eedb85be81bde9ed73301b3b88000048961
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          qwen.toml
                                                          • Path C:\Users\Admin\AppData\Local\herdr\agent-detection\remote\qwen.toml
                                                          • Size 3KB
                                                          • SHA256 b27aa456af228e8a4ceac74f0dd431c33b21473b69314fc672a7fba474e2a7fe
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          herdr-client.sock
                                                          • Path C:\Users\Admin\AppData\Roaming\herdr\herdr-client.sock
                                                          • Size 24B
                                                          • SHA256 9efac3f4848b4b5804024aa8739a46c7696010df7acaa7f07d914fb0e4984235
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          release-notes.json
                                                          • Path C:\Users\Admin\AppData\Roaming\herdr\release-notes.json
                                                          • Size 6KB
                                                          • SHA256 a3c32f894f35ad5b943dac24bb5ad697eb229b239ebf847f772a7b1e2d2d6ced
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          session.json
                                                          • Path C:\Users\Admin\AppData\Roaming\herdr\session.json
                                                          • Size 821B
                                                          • SHA256 f293eab6455d2001c2a42b09d851a19c38d0b64d9cf85580fc92ddfa6dcfeb0a
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          memory/4240-10-0x00000143A6300000-0x00000143A6322000-memory.dmp
                                                          Download

                                                          memory/4240-11-0x00000143BED50000-0x00000143BED98000-memory.dmp
                                                          Download