Overview

overview

3

Static

static

3

2026-10-21...om.exe

windows10-2004-x64

1

2026-10-21...om.exe

windows11-ltsc_2024-x64

1

Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/10/2026, 16:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-21_955934ae550ee5fee7940cb6a33184cb_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe
  • Size 18.7MB
  • Sample261022-valzassvb1
  • SHA256 d160aa5b6c7d98493fb4a6d20687eccb9ae8f0a62495397142484369ea333202
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-21_955934ae550ee5fee7940cb6a33184cb_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-21_955934ae550ee5fee7940cb6a33184cb_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:6040
    • C:\Users\Admin\AppData\Local\Temp\2026-10-21_955934ae550ee5fee7940cb6a33184cb_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-10-21_955934ae550ee5fee7940cb6a33184cb_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe" --ignored --exact runtime::diagnostics::tests::host_failure_crash_child --nocapture
      2⤵
        PID:4460
      • C:\Users\Admin\AppData\Local\Temp\2026-10-21_955934ae550ee5fee7940cb6a33184cb_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-10-21_955934ae550ee5fee7940cb6a33184cb_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe" --ignored --exact runtime::diagnostics::tests::minecraft_crash_child --nocapture
        2⤵
          PID:3456
        • C:\Users\Admin\AppData\Local\Temp\2026-10-21_955934ae550ee5fee7940cb6a33184cb_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe
          "C:\Users\Admin\AppData\Local\Temp\2026-10-21_955934ae550ee5fee7940cb6a33184cb_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe" --ignored --exact runtime::diagnostics::tests::eos_library_load_child
          2⤵
            PID:4832
          • C:\Users\Admin\AppData\Local\Temp\2026-10-21_955934ae550ee5fee7940cb6a33184cb_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-10-21_955934ae550ee5fee7940cb6a33184cb_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe" --ignored --exact runtime::diagnostics::tests::anti_cheat_violation_child --nocapture
            2⤵
              PID:2100
            • C:\Users\Admin\AppData\Local\Temp\2026-10-21_955934ae550ee5fee7940cb6a33184cb_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe
              "C:\Users\Admin\AppData\Local\Temp\2026-10-21_955934ae550ee5fee7940cb6a33184cb_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe" --ignored --exact runtime::diagnostics::tests::panic_child --nocapture
              2⤵
                PID:2044
              • C:\Users\Admin\AppData\Local\Temp\2026-10-21_955934ae550ee5fee7940cb6a33184cb_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-10-21_955934ae550ee5fee7940cb6a33184cb_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe" --ignored --exact runtime::diagnostics::tests::developer_profile_child
                2⤵
                  PID:1752
                • C:\Users\Admin\AppData\Local\Temp\2026-10-21_955934ae550ee5fee7940cb6a33184cb_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe
                  "C:\Users\Admin\AppData\Local\Temp\2026-10-21_955934ae550ee5fee7940cb6a33184cb_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe" --ignored --exact runtime::integrity::tests::local_silence_child --nocapture
                  2⤵
                    PID:3420
                  • C:\Users\Admin\AppData\Local\Temp\2026-10-21_955934ae550ee5fee7940cb6a33184cb_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-10-21_955934ae550ee5fee7940cb6a33184cb_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe" --ignored --exact runtime::diagnostics::tests::developer_profile_child
                    2⤵
                      PID:1444
                    • C:\Users\Admin\AppData\Local\Temp\2026-10-21_955934ae550ee5fee7940cb6a33184cb_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe
                      "C:\Users\Admin\AppData\Local\Temp\2026-10-21_955934ae550ee5fee7940cb6a33184cb_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe" --ignored --exact session::errors::tests::rejection_reason_child
                      2⤵
                        PID:4404

                    Network

                          MITRE ATT&CK Matrix

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          jvm-replay-07.log
                          • Path C:\Users\Admin\AppData\Local\Temp\asterfall-crash-slot-6040-1792687647391947300\jvm-replay-07.log
                          • Size 5B
                          • SHA256 a03f2386ae06b21109577020844df367857b72c2fcce384c1896fed98a89c82b
                          • MD5 SHA1 SHA512
                          Submit Download

                          report.json
                          • Path C:\Users\Admin\AppData\Local\Temp\asterfall-report-6040-1792687647433867200\report.json
                          • Size 6B
                          • SHA256 845e91831319e89c4d656bdb80c278ac09a7230d61e5dfd2e1b1fbb436ac8917
                          • MD5 SHA1 SHA512
                          Submit Download