f2c11a4f9eb085f6e3f50c132880dac075591c0552a0f7a6ad3f9465f893c310

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 07:00

Target
2026-10-23_d887fcd0621872c07debc552702dbf63_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Size 17.2MB
Sample261023-hstqmscd62
SHA256 f2c11a4f9eb085f6e3f50c132880dac075591c0552a0f7a6ad3f9465f893c310
MD5 d887fcd0621872c07debc552702dbf63
SHA1 579896525b44679836304888793f2f62dd43a511
SHA512 166f66bf566f3e264e15e0f5aaa7b958afbeaf1a1d90110f09c7e88b70e70f7dfe862535ab0159c57398f2c555d430213b506434a424e574cedee344f889d925
SSDEEP 196608:rGUe7Y3ofsp/Td3KBYWhzB/Ad0JJZh0tLGaAOjpB:rxeM3WXzB/A6JZgLGaAOjpB
TLSH
T1A5076B03F39291EDC46AC1B4835AA233FA717C4D47347AEB5BD48B212E65BD09A3C749
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
5428	2026-10-23_d887fcd0621872c07debc552702dbf63_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5428	2026-10-23_d887fcd0621872c07debc552702dbf63_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5428	2026-10-23_d887fcd0621872c07debc552702dbf63_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5428	2026-10-23_d887fcd0621872c07debc552702dbf63_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5428	2026-10-23_d887fcd0621872c07debc552702dbf63_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5428 wrote to memory of 4100	5428	2026-10-23_d887fcd0621872c07debc552702dbf63_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-10-23_d887fcd0621872c07debc552702dbf63_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-23_d887fcd0621872c07debc552702dbf63_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5428
- C:\Users\Admin\AppData\Local\Temp\2026-10-23_d887fcd0621872c07debc552702dbf63_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_d887fcd0621872c07debc552702dbf63_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe" -m
  2⤵
  PID:4100