Analysis
- max time kernel
149s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
30/10/2026, 06:32
General
- Target 2026-10-28_3b411d87cdfe3386ef278782a6f6482f_akira_cobalt-strike_rusty-stealer_satacom.exe
- Size 614KB
- Sample261030-halbjswyhs
- SHA256 e53aaa4e3a3a0a190e04f31d764b16db408abfea8867b9e074cfbd4209cb572b
Malware Config
Signatures
- Detects executables manipulated with Fody 3 IoCs
- Executes a file named after a Windows system binary 1 TTPs 4 IoCs
The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
- Executes dropped EXE 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-28_3b411d87cdfe3386ef278782a6f6482f_akira_cobalt-strike_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-28_3b411d87cdfe3386ef278782a6f6482f_akira_cobalt-strike_rusty-stealer_satacom.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3615211118.exe"C:\Users\Admin\AppData\Local\Temp\3615211118.exe"2⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\lsass.exe"C:\Users\Admin\AppData\Roaming\lsass.exe" /fromstartup3⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
-
C:\Users\Admin\AppData\Roaming\lsass.exeC:\Users\Admin\AppData\Roaming\lsass.exe1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\lsass.exe"C:\Users\Admin\AppData\Roaming\lsass.exe" /fromstartup2⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
3615211118.exe
a.txt
a.txt
a.txt
a.txt
a.txt
a.txt
a.txt
a.txt
a.txt
a.txt
a.txt
a.txt
a.txt
a.txt
a.txt
a.txt
a.txt
a.txt
a.txt
a.txt
a.txt
a.txt
a.txt
memory/1484-22-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp
memory/1484-27-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp
memory/1484-26-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp
memory/1484-25-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp
memory/1484-28-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp
memory/1484-31-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp
memory/1484-34-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp
memory/1484-42-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp
memory/3136-17-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp
memory/3136-10-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp
memory/3136-6-0x00000293D5810000-0x00000293D584C000-memory.dmp
memory/3136-9-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp
memory/3136-12-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp
memory/3136-5-0x00000293D3A80000-0x00000293D3AF6000-memory.dmp
memory/3136-13-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp
memory/3136-8-0x00000293D5950000-0x00000293D59A8000-memory.dmp
memory/3136-4-0x00007FFB23A5F000-0x00007FFB23A60000-memory.dmp