Overview

overview

7

Static

static

1

2026-07-03...ar.exe

windows10-2004-x64

7

2026-07-03...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    71s
  • max time network
    157s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/07/2026, 06:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-03_d620ce2af6dfbca8c097a0b36a784a88_akira_cobalt-strike_icedid_satacom_vidar.exe
  • Size 21.3MB
  • Sample260703-g6waysht8m
  • SHA256 71e8d2b63cc34224c0b3a9f7a981a63f9cdcdf70168794f862a84a2bb79ba51d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwaredefense_evasiondiscoverypersistencespyware

Malware Config

Signatures

  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 55 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 2 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 29 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 31 IoCs
  • Suspicious use of FindShellTrayWindow 49 IoCs
  • Suspicious use of SendNotifyMessage 39 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-03_d620ce2af6dfbca8c097a0b36a784a88_akira_cobalt-strike_icedid_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-03_d620ce2af6dfbca8c097a0b36a784a88_akira_cobalt-strike_icedid_satacom_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5916
    • C:\Windows\system32\taskkill.exe
      "taskkill" /F /IM RuntimeBroker_rustdesk.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:3376
    • C:\Users\Admin\AppData\Local\rustdesk\Sander IT Consulting Fernwartung.exe
      "C:\Users\Admin\AppData\Local\rustdesk\.\Sander IT Consulting Fernwartung.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2796
      • C:\Windows\system32\icacls.exe
        "icacls" "C:\ProgramData\Sander IT Consulting Fernwartung" /grant *S-1-1-0:(OI)(CI)F /T
        3⤵
        • Modifies file permissions
        PID:3552
      • C:\Windows\system32\icacls.exe
        "icacls" "C:\ProgramData\Sander IT Consulting Fernwartung\shared_memory_portable_service" /grant *S-1-1-0:(OI)(CI)F /T
        3⤵
        • Modifies file permissions
        PID:2592
      • C:\Users\Admin\AppData\Local\rustdesk\Sander IT Consulting Fernwartung.exe
        "C:\Users\Admin\AppData\Local\rustdesk\Sander IT Consulting Fernwartung.exe" --portable-service
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5700
        • C:\Users\Admin\AppData\Local\rustdesk\Sander IT Consulting Fernwartung.exe
          "C:\Users\Admin\AppData\Local\rustdesk\Sander IT Consulting Fernwartung.exe" --run-as-system
          4⤵
          • Drops file in Windows directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          PID:3336
      • C:\Windows\system32\cmd.exe
        "cmd" /c "taskkill /F /IM RuntimeBroker_rustdesk.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3912
        • C:\Windows\system32\taskkill.exe
          taskkill /F /IM RuntimeBroker_rustdesk.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3020
      • C:\Users\Admin\AppData\Local\rustdesk\Sander IT Consulting Fernwartung.exe
        "C:\Users\Admin\AppData\Local\rustdesk\.\Sander IT Consulting Fernwartung.exe" --check-hwcodec-config
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5840
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1172
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:3404
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1088
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:824

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        shared_memory_portable_service
        • Path C:\ProgramData\Sander IT Consulting Fernwartung\shared_memory_portable_service
        • Size 23B
        • SHA256 16f7d38f8c50938c5398b7f7c588d59c0a4d96a6873ec6bf0b735d3972fec58a
        • MD5 SHA1 SHA512
        Submit Download

        prep_Activatable Class_Hermes_perf.cache
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
        • Size 607B
        • SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Sander IT Consulting Fernwartung.exe
        • Path C:\Users\Admin\AppData\Local\rustdesk\Sander IT Consulting Fernwartung.exe
        • Size 275KB
        • SHA256 e964b2c455cfe70a9cb4f36070f231dd6768ab5dab0beef5356a6be3b7fa5c1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        custom.txt
        • Path C:\Users\Admin\AppData\Local\rustdesk\custom.txt
        • Size 828B
        • SHA256 1fa9397af5ff88d41ff6379670006dddc9fa0c095754209a6c8b278441dc7877
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        app.so
        • Path C:\Users\Admin\AppData\Local\rustdesk\data\app.so
        • Size 11.8MB
        • SHA256 1a58b004d1860f1ca16462ed1b922158bca740f2a532da075667178ea02bd27b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AssetManifest.bin
        • Path C:\Users\Admin\AppData\Local\rustdesk\data\flutter_assets\AssetManifest.bin
        • Size 4KB
        • SHA256 15ceefb18609b8d0000c04ab303763b733979f9bdc301719a747fd82ccbfec85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        FontManifest.json
        • Path C:\Users\Admin\AppData\Local\rustdesk\data\flutter_assets\FontManifest.json
        • Size 427B
        • SHA256 1fe061a94b72c283e59b6a7a8fcac8d3e15422c40a496f36272f3043e95c4134
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        icon.svg
        • Path C:\Users\Admin\AppData\Local\rustdesk\data\flutter_assets\assets\icon.svg
        • Size 76KB
        • SHA256 1e30d87f238ba4444d0d40da1f4e78357871993c2a58b51303e6e4cfeb27030e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        logo.png
        • Path C:\Users\Admin\AppData\Local\rustdesk\data\flutter_assets\assets\logo.png
        • Size 55KB
        • SHA256 0bc378a35d0217a627f796fe102f3572b33ff3b4558f445a6cdeddf82fe38a3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tabbar.ttf
        • Path C:\Users\Admin\AppData\Local\rustdesk\data\flutter_assets\assets\tabbar.ttf
        • Size 2KB
        • SHA256 a17ca0a8f7d5aa5ea3f6380f3a282b98b3d66135bb0cee5d431082f560030db8
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        MaterialIcons-Regular.otf
        • Path C:\Users\Admin\AppData\Local\rustdesk\data\flutter_assets\fonts\MaterialIcons-Regular.otf
        • Size 1.6MB
        • SHA256 d9865b671a09d683d13a863089d8825e0f61a37696ce5d7d448bc8023aa62453
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        icudtl.dat
        • Path C:\Users\Admin\AppData\Local\rustdesk\data\icudtl.dat
        • Size 760KB
        • SHA256 c12537022ef818991a7bfed41a76d8d6ae962ffbc0e6511ac762a5d0845e7f7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        desktop_drop_plugin.dll
        • Path C:\Users\Admin\AppData\Local\rustdesk\desktop_drop_plugin.dll
        • Size 330KB
        • SHA256 0bd9632e0de35562c354a46edcf4ca1d068358184ad159d79af62ca73a910429
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        desktop_multi_window_plugin.dll
        • Path C:\Users\Admin\AppData\Local\rustdesk\desktop_multi_window_plugin.dll
        • Size 406KB
        • SHA256 06aa8f1cbd68cdc3943851731086ca77a1cce1bb11effd640f5484287cab63f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        file_selector_windows_plugin.dll
        • Path C:\Users\Admin\AppData\Local\rustdesk\file_selector_windows_plugin.dll
        • Size 353KB
        • SHA256 ac927c9a3263ad00ab61d86ab59c0673a7e8cccdda782c1a4dffaedb678b8a5c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        flutter_custom_cursor_plugin.dll
        • Path C:\Users\Admin\AppData\Local\rustdesk\flutter_custom_cursor_plugin.dll
        • Size 322KB
        • SHA256 1bbe91ad2967180fd467aa7410c24f4b6ffd0784407b420040151dacb3eb43c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        flutter_gpu_texture_renderer_plugin.dll
        • Path C:\Users\Admin\AppData\Local\rustdesk\flutter_gpu_texture_renderer_plugin.dll
        • Size 353KB
        • SHA256 f9546dc165ec5199ea47cc76d19e85d7c7bd985c2037b141d56f3e70f9c2dbab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        flutter_windows.dll
        • Path C:\Users\Admin\AppData\Local\rustdesk\flutter_windows.dll
        • Size 17.2MB
        • SHA256 038ab6a8afe4b28e917b09941b6803ea4309e46d949ea73c254ce03277bd4f5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        librustdesk.dll
        • Path C:\Users\Admin\AppData\Local\rustdesk\librustdesk.dll
        • Size 30.5MB
        • SHA256 0370601daa129d231aee092c28c20cca816d34ce4fc43b88c5461ca2aa96e0d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        screen_retriever_plugin.dll
        • Path C:\Users\Admin\AppData\Local\rustdesk\screen_retriever_plugin.dll
        • Size 547KB
        • SHA256 63b8d7691ba3264c216148c2aa49c5e6fd0dbe6183a5ecec63a66e4a634dbf7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        texture_rgba_renderer_plugin.dll
        • Path C:\Users\Admin\AppData\Local\rustdesk\texture_rgba_renderer_plugin.dll
        • Size 331KB
        • SHA256 56e00563d121f457ec2fe8611a8c301a54d3a34d48f9ac18ab11f954d8425f9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        uni_links_desktop_plugin.dll
        • Path C:\Users\Admin\AppData\Local\rustdesk\uni_links_desktop_plugin.dll
        • Size 545KB
        • SHA256 deef3b20857e7a4f2e1ceb769fdf888259dba418c452b4d3714f39a52a039a26
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        url_launcher_windows_plugin.dll
        • Path C:\Users\Admin\AppData\Local\rustdesk\url_launcher_windows_plugin.dll
        • Size 331KB
        • SHA256 18151c80a7b9bf8812f8dcf081706ea2f6e1be524c31bfbc7ff4d57166b8103a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        window_manager_plugin.dll
        • Path C:\Users\Admin\AppData\Local\rustdesk\window_manager_plugin.dll
        • Size 590KB
        • SHA256 54d1858b09158fc18bd8348ab766b257e1f35868698b593977c2a5ea9d5696f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        window_size_plugin.dll
        • Path C:\Users\Admin\AppData\Local\rustdesk\window_size_plugin.dll
        • Size 542KB
        • SHA256 dc845b0e7e663df23f9db543ac65deefde3a4a11da5c0338799395fdc873a81c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/824-499-0x000002241D420000-0x000002241D440000-memory.dmp
        Download

        memory/824-463-0x000002240CC40000-0x000002240CC60000-memory.dmp
        Download

        memory/824-464-0x000002241D0A0000-0x000002241D1A0000-memory.dmp
        Download

        memory/824-475-0x000002240CEA0000-0x000002240CEC0000-memory.dmp
        Download

        memory/824-453-0x0000022409500000-0x0000022409600000-memory.dmp
        Download

        memory/1088-641-0x000001B3C8000000-0x000001B3C8691000-memory.dmp
        Download

        memory/2796-154-0x000001F864770000-0x000001F865341000-memory.dmp
        Download

        memory/2796-152-0x000001F85E510000-0x000001F85E511000-memory.dmp
        Download

        memory/2796-156-0x000001F85E520000-0x000001F85E521000-memory.dmp
        Download

        memory/2796-153-0x000001F864770000-0x000001F865341000-memory.dmp
        Download

        memory/2796-155-0x000001F864770000-0x000001F865341000-memory.dmp
        Download