Analysis
- max time kernel
149s - max time network
95s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
03/06/2026, 16:50
General
- Target 2026-06-03_019408ed715ec8f8e8cc0dbd0a30955c_akira_icedid_rusty-stealer.exe
- Size 12.1MB
- Sample260603-vcdqpsc13p
- SHA256 37b2a9849c93760c2520c2a7174e81561370c95739df9c987413f6e0acd00b3b
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
- Detect binaries embedding considerable number of MFA browser extension IDs. 1 IoCs
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Using powershell.exe command.
- Drops startup file 1 IoCs
- Executes dropped EXE 3 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 3 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-03_019408ed715ec8f8e8cc0dbd0a30955c_akira_icedid_rusty-stealer.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-03_019408ed715ec8f8e8cc0dbd0a30955c_akira_icedid_rusty-stealer.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e3ac4b9b686a.exe"C:\Users\Admin\AppData\Local\Temp\e3ac4b9b686a.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -C "Add-MpPreference -ExclusionExtension '.exe' -EA 0"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -C "Add-MpPreference -ExclusionExtension '.exe' -EA 0"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_FsOAEuLjiyoWJtG.exe"C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_FsOAEuLjiyoWJtG.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_FsOAEuLjiyoWJtG.exeC:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_FsOAEuLjiyoWJtG.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command " $action = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_FsOAEuLjiyoWJtG.exe' $trigger = New-ScheduledTaskTrigger -AtLogOn Register-ScheduledTask -Action $action -Trigger $trigger -TaskName 'CoreWorker_FsOAEuLjiyoWJtG-9724' -RunLevel Highest "2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\MpDefenderCoreFolder'"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\MpDefenderCoreFolder'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CoreWorker_FsOAEuLjiyoWJtG.exe.log
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
CoreWorker_FsOAEuLjiyoWJtG.exe
__PSScriptPolicyTest_zb55ssq1.ct3.ps1
e3ac4b9b686a.exe
memory/1264-111-0x00000161DBB40000-0x00000161DC602000-memory.dmp
memory/1264-101-0x00000161F4CD0000-0x00000161F4D83000-memory.dmp
memory/2160-20-0x000001943F910000-0x000001943F920000-memory.dmp
memory/2160-16-0x00000194401F0000-0x0000019440718000-memory.dmp
memory/2160-18-0x000001943F910000-0x000001943F920000-memory.dmp
memory/2160-21-0x0000019440920000-0x0000019440B10000-memory.dmp
memory/2160-23-0x000001943F910000-0x000001943F920000-memory.dmp
memory/2160-22-0x000001943F910000-0x000001943F920000-memory.dmp
memory/2160-25-0x000001943F910000-0x000001943F920000-memory.dmp
memory/2160-26-0x0000019426F80000-0x0000019426F92000-memory.dmp
memory/2160-10-0x0000019425150000-0x0000019425258000-memory.dmp
memory/2160-11-0x000001943F910000-0x000001943F920000-memory.dmp
memory/2160-30-0x000001943F850000-0x000001943F8A0000-memory.dmp
memory/2160-12-0x0000019425660000-0x0000019425661000-memory.dmp
memory/2160-13-0x0000019426F00000-0x0000019426F76000-memory.dmp
memory/2160-17-0x000001943F910000-0x000001943F920000-memory.dmp
memory/2160-14-0x000001943FAF0000-0x000001943FCB2000-memory.dmp
memory/2160-15-0x000001943F910000-0x000001943F920000-memory.dmp
memory/2160-19-0x000001943FCC0000-0x000001943FEB1000-memory.dmp
memory/2160-61-0x000001943F910000-0x000001943F920000-memory.dmp
memory/2160-60-0x000001943F910000-0x000001943F920000-memory.dmp
memory/2160-59-0x000001943F910000-0x000001943F920000-memory.dmp
memory/2160-55-0x000001943F910000-0x000001943F920000-memory.dmp
memory/2456-31-0x000001E732890000-0x000001E7328A0000-memory.dmp
memory/3492-27-0x000001E3A81E0000-0x000001E3A81F0000-memory.dmp
memory/3492-28-0x000001E3C15E0000-0x000001E3C15FE000-memory.dmp
memory/3784-76-0x00000243ACF00000-0x00000243ACF0A000-memory.dmp
memory/4552-112-0x000002457EBE0000-0x000002457F6A2000-memory.dmp
memory/4644-51-0x000001C2A34F0000-0x000001C2A350A000-memory.dmp
memory/4644-50-0x000001C2A3340000-0x000001C2A334A000-memory.dmp
memory/4644-49-0x000001C2A34D0000-0x000001C2A34EC000-memory.dmp
memory/4644-48-0x000001C2A3220000-0x000001C2A322A000-memory.dmp
memory/4644-53-0x000001C2A3360000-0x000001C2A3366000-memory.dmp
memory/4644-47-0x000001C2A3250000-0x000001C2A3303000-memory.dmp
memory/4644-46-0x000001C2A3230000-0x000001C2A324C000-memory.dmp
memory/4644-33-0x000001C2A2F80000-0x000001C2A2FA2000-memory.dmp
memory/4644-58-0x000001C28A1D0000-0x000001C28AC92000-memory.dmp
memory/4644-52-0x000001C2A3350000-0x000001C2A3358000-memory.dmp
memory/4644-54-0x000001C2A3510000-0x000001C2A351A000-memory.dmp