Overview

overview

10

Static

static

5

2026-04-19...er.exe

windows10-2004-x64

10

2026-04-19...er.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    19/04/2026, 23:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-19_3072230fc0e177f2331ac49615860c94_akira_icedid_rusty-stealer.exe
  • Size 3.0MB
  • Sample260419-3wefcads6k
  • SHA256 2da2a91b079794bdd3267d6ee31f3256aec95b2ad4cfb41cd6bc0228b0bfc6ab
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
    defense_evasiontrojan
  • Modifies Windows Defender notification settings 3 TTPs 4 IoCs
    defense_evasiontrojan
  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 2 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
  • Enumerates VirtualBox registry keys 2 TTPs 3 IoCs
    defense_evasion
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    defense_evasion
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
    defense_evasion
  • Executes dropped EXE 4 IoCs
  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-19_3072230fc0e177f2331ac49615860c94_akira_icedid_rusty-stealer.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-19_3072230fc0e177f2331ac49615860c94_akira_icedid_rusty-stealer.exe"
    1⤵
    • Enumerates VirtualBox registry keys
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Identifies Wine through registry keys
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5196
    • C:\Users\Admin\AppData\Local\MsUpdate\taskhost64.exe
      "C:\Users\Admin\AppData\Local\MsUpdate\taskhost64.exe"
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • Modifies Windows Defender notification settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:940
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /c net stop WinDefend /y >nul 2>&1 & net stop wscsvc /y >nul 2>&1 & net stop Sense /y >nul 2>&1
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3196
        • C:\Windows\system32\net.exe
          net stop WinDefend /y
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2076
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 stop WinDefend /y
            5⤵
              PID:568
          • C:\Windows\system32\net.exe
            net stop wscsvc /y
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1676
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 stop wscsvc /y
              5⤵
                PID:1088
            • C:\Windows\system32\net.exe
              net stop Sense /y
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:3188
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 stop Sense /y
                5⤵
                  PID:4128
          • C:\Windows\System32\Wbem\mofcomp.exe
            mofcomp.exe "C:\Users\Admin\AppData\Local\Temp\_wd.mof"
            2⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:3732
          • C:\Windows\System32\Wbem\mofcomp.exe
            mofcomp.exe "C:\Users\Admin\AppData\Local\Temp\_ws.mof"
            2⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1948
          • C:\Windows\system32\schtasks.exe
            "schtasks" /create /tn \Microsoft\Windows\WindowsUpdate\AutoUpdate /tr C:\Users\Admin\AppData\Local\MsUpdate\taskhost64.exe /sc ONLOGON /ru SYSTEM /rl HIGHEST /f
            2⤵
            • Scheduled Task/Job: Scheduled Task
            PID:4596
        • C:\Users\Admin\AppData\Local\MsUpdate\taskhost64.exe
          C:\Users\Admin\AppData\Local\MsUpdate\taskhost64.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5180
        • C:\ProgramData\Microsoft\SystemAppVerifier\NetDiagSvc.exe
          C:\ProgramData\Microsoft\SystemAppVerifier\NetDiagSvc.exe
          1⤵
          • Executes dropped EXE
          PID:564
        • C:\ProgramData\Microsoft\SystemAppVerifier\taskhost64.exe
          C:\ProgramData\Microsoft\SystemAppVerifier\taskhost64.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4264

        Network

              MITRE ATT&CK Enterprise v16

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              Persistence

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Create or Modify System Process

              2
              T1543

              Windows Service

              2
              T1543.003

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              Privilege Escalation

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Create or Modify System Process

              2
              T1543

              Windows Service

              2
              T1543.003

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              Defense Evasion

              Impair Defenses

              2
              T1562

              Disable or Modify Tools

              2
              T1562.001

              Modify Registry

              3
              T1112

              Virtualization/Sandbox Evasion

              4
              T1497

              Credential Access

              Credentials from Password Stores

              1
              T1555

              Credentials from Web Browsers

              1
              T1555.003

              Unsecured Credentials

              1
              T1552

              Credentials In Files

              1
              T1552.001

              Discovery

              Browser Information Discovery

              1
              T1217

              Query Registry

              6
              T1012

              Virtualization/Sandbox Evasion

              4
              T1497

              Lateral Movement

              Collection

              Data from Local System

              1
              T1005

              Command and Control

              Exfiltration

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              NetDiagSvc.exe
              • Path C:\ProgramData\Microsoft\SystemAppVerifier\NetDiagSvc.exe
              • Size 194KB
              • SHA256 1196d783dd7c2896a2de793b9cdc5b716914838fc7075b1c5b47299d830c832b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              dnssd.dll
              • Path C:\Users\Admin\AppData\Local\MsUpdate\dnssd.dll
              • Size 349KB
              • SHA256 908f5fd0455976ad7dc12f352cbf519ce8fb202f324447c4de76dbf77ea51a9d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              session.cfg
              • Path C:\Users\Admin\AppData\Local\MsUpdate\session.cfg
              • Size 323KB
              • SHA256 5c19639aaa00d526df183a7da3aa49122eabfa28e4c305e7aded10fc4d7c4238
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              taskhost64.exe
              • Path C:\Users\Admin\AppData\Local\MsUpdate\taskhost64.exe
              • Size 116KB
              • SHA256 319f8de530c43ef2c0b5d4226ffdf2737c3a9c35dbc7efb8ebfc3312b5dac552
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vcruntime140.dll
              • Path C:\Users\Admin\AppData\Local\MsUpdate\vcruntime140.dll
              • Size 120KB
              • SHA256 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _wd.mof
              • Path C:\Users\Admin\AppData\Local\Temp\_wd.mof
              • Size 349B
              • SHA256 4893ece6669058bf6e2c3655ccba8f00ef61158457451929e78cbc64d0deee01
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              _ws.mof
              • Path C:\Users\Admin\AppData\Local\Temp\_ws.mof
              • Size 516B
              • SHA256 172b47f8870071f49e22fc318e967aeb0321b711fbc833bbb54fbd23f7404070
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              stub_debug.log
              • Path C:\Users\Admin\AppData\Local\Temp\stub_debug.log
              • Size 201B
              • SHA256 e04656e8bf424b524c512327166716b5cd688331087b97c32b88725776c07930
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              memory/940-33-0x0000000001760000-0x00000000017B7000-memory.dmp
              Download

              memory/940-53-0x0000000001760000-0x00000000017B7000-memory.dmp
              Download