63bec8a611ecf6b52e05bba860927e0fb857487c461226832a276c6b145a5460

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 03:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_9799722c3a79cd884a8f4342e611dd94_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Size 23.6MB
Sample261024-ec1mgafw3s
SHA256 63bec8a611ecf6b52e05bba860927e0fb857487c461226832a276c6b145a5460
MD5 9799722c3a79cd884a8f4342e611dd94
SHA1 1fc6280aef17ac021373f9df64f36c4894d0d2ea
SHA512 8cc43fed4f2ae4e42761f5ef3992ca70a8b330cc1228868e17022b2b50167888f590cd757cc3adefd7d1290832fe6d63f7c5dc810a720d1921ea5d87a2a64d8f
SSDEEP 196608:Kg8AvR4UFUVTHUL5t6cAe4ZXGJyIYcypIIeCeNz:HtJ4UFUVTHUvLn6X3Ne
TLSH
T1F94729166679A0D9D1BBC0B8D2838F22BD2174D947393BF745D0826A2F24EF8AD3C754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 3756	1236	2026-10-22_9799722c3a79cd884a8f4342e611dd94_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	91
PID 1236 wrote to memory of 5400	1236	2026-10-22_9799722c3a79cd884a8f4342e611dd94_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	92
PID 1236 wrote to memory of 3380	1236	2026-10-22_9799722c3a79cd884a8f4342e611dd94_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	93
PID 1236 wrote to memory of 1728	1236	2026-10-22_9799722c3a79cd884a8f4342e611dd94_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	94
PID 1236 wrote to memory of 5812	1236	2026-10-22_9799722c3a79cd884a8f4342e611dd94_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	95
PID 1236 wrote to memory of 4748	1236	2026-10-22_9799722c3a79cd884a8f4342e611dd94_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	96
PID 1236 wrote to memory of 4840	1236	2026-10-22_9799722c3a79cd884a8f4342e611dd94_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	97
PID 1236 wrote to memory of 5908	1236	2026-10-22_9799722c3a79cd884a8f4342e611dd94_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	98
PID 1236 wrote to memory of 5676	1236	2026-10-22_9799722c3a79cd884a8f4342e611dd94_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	99
PID 1236 wrote to memory of 2480	1236	2026-10-22_9799722c3a79cd884a8f4342e611dd94_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-10-22_9799722c3a79cd884a8f4342e611dd94_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_9799722c3a79cd884a8f4342e611dd94_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Users\Admin\AppData\Local\Temp\2026-10-22_9799722c3a79cd884a8f4342e611dd94_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9799722c3a79cd884a8f4342e611dd94_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe" --ignored --exact runtime::diagnostics::tests::minecraft_crash_child --nocapture
  2⤵
  PID:3756
- C:\Users\Admin\AppData\Local\Temp\2026-10-22_9799722c3a79cd884a8f4342e611dd94_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9799722c3a79cd884a8f4342e611dd94_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe" --ignored --exact runtime::diagnostics::tests::host_failure_crash_child --nocapture
  2⤵
  PID:5400
- C:\Users\Admin\AppData\Local\Temp\2026-10-22_9799722c3a79cd884a8f4342e611dd94_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9799722c3a79cd884a8f4342e611dd94_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe" --ignored --exact runtime::diagnostics::tests::eos_library_load_child
  2⤵
  PID:3380
- C:\Users\Admin\AppData\Local\Temp\2026-10-22_9799722c3a79cd884a8f4342e611dd94_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9799722c3a79cd884a8f4342e611dd94_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe" --ignored --exact runtime::diagnostics::tests::anti_cheat_violation_child --nocapture
  2⤵
  PID:1728
- C:\Users\Admin\AppData\Local\Temp\2026-10-22_9799722c3a79cd884a8f4342e611dd94_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9799722c3a79cd884a8f4342e611dd94_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe" --ignored --exact runtime::diagnostics::tests::panic_child --nocapture
  2⤵
  PID:5812
- C:\Users\Admin\AppData\Local\Temp\2026-10-22_9799722c3a79cd884a8f4342e611dd94_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9799722c3a79cd884a8f4342e611dd94_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe" --ignored --exact runtime::diagnostics::tests::developer_profile_child
  2⤵
  PID:4748
- C:\Users\Admin\AppData\Local\Temp\2026-10-22_9799722c3a79cd884a8f4342e611dd94_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9799722c3a79cd884a8f4342e611dd94_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe" --ignored --exact runtime::diagnostics::tests::developer_profile_child
  2⤵
  PID:4840
- C:\Users\Admin\AppData\Local\Temp\2026-10-22_9799722c3a79cd884a8f4342e611dd94_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9799722c3a79cd884a8f4342e611dd94_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe" --ignored --exact runtime::eos::tests::protected_session_report_child --nocapture
  2⤵
  PID:5908
- C:\Users\Admin\AppData\Local\Temp\2026-10-22_9799722c3a79cd884a8f4342e611dd94_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9799722c3a79cd884a8f4342e611dd94_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe" --ignored --exact runtime::integrity::tests::local_silence_child --nocapture
  2⤵
  PID:5676
- C:\Users\Admin\AppData\Local\Temp\2026-10-22_9799722c3a79cd884a8f4342e611dd94_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9799722c3a79cd884a8f4342e611dd94_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe" --ignored --exact session::errors::tests::rejection_reason_child
  2⤵
  PID:2480

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

jvm-replay-07.log

Path C:\Users\Admin\AppData\Local\Temp\asterfall-crash-slot-1236-1792813725501409300\jvm-replay-07.log
Size 5B
SHA256 a03f2386ae06b21109577020844df367857b72c2fcce384c1896fed98a89c82b
MD5 36f34fd8319cf30f8e132ef294c616af
SHA1 a4e976a3d3fc6d0b40453de216fbbe2e9aaecdc4
SHA512 78f9a28405318487a210483c84cb0906953400f111092ff04a08fe573a809b9b2db7555a8cd24e49eeb6d98812abd68de0b66ea818a16088092cf99cef8e131b
MD5 SHA1 SHA512

Submit Download

report.json

Path C:\Users\Admin\AppData\Local\Temp\asterfall-report-1236-1792813725547435800\report.json
Size 6B
SHA256 845e91831319e89c4d656bdb80c278ac09a7230d61e5dfd2e1b1fbb436ac8917
MD5 e98d2f001da5678b39482efbdf5770dc
SHA1 a27297bde9732f2e73fbc06db2611764e3ad9855
SHA512 4e67d7194cf6de9f6202d68155164f7c424fae559d46fc8180bc3388c2a151f8351183a44dcc99b9af1608dcdd3213f2b5105bdab3371082f6cb2e52bbdf4fb1
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads