af026dbc9daf795392256da5fb6a5e31089c453f596b76c50d8dc44e40bbad7c

General

Target
2026-07-18_0df0d21b93d8857864be8b58d0173257_akira_rusty-stealer.exe
Size 491KB
Sample260718-bmb53sbw2n
SHA256 af026dbc9daf795392256da5fb6a5e31089c453f596b76c50d8dc44e40bbad7c
MD5 0df0d21b93d8857864be8b58d0173257
SHA1 9d07ec3a6d7ba04cb84768a03c06b0cf62a0a2d3
SHA512 5bf4f9d6824d9b54f43fdf3f866bc51781eee1d38fc63ed0f9f75811e0b1aab8e3333465430d4b0a4df328407367be745e98c63797d8eb51a749706ea13083c9
SSDEEP 6144:iRQXhqWf9steSSHs6G/1REmcf1hW9c3a2iZkMuDzQYUzsHuCP62b/y8UWYOPiReN:iSXhtfptY5K1QFNsZ6k/y85tXG
TLSH
T148B46C53F6444AFCD05AC474835A5563BA32B4CA0B22F9EF269C42312F66EE65F3D708
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion persistence

Malware Config

Signatures

Disables RegEdit via registry modification 2 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	2026-07-18_0df0d21b93d8857864be8b58d0173257_akira_rusty-stealer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	2026-07-18_0df0d21b93d8857864be8b58d0173257_akira_rusty-stealer.exe

Disables Task Manager via registry modification
defense_evasion

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 24 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "C:\\Windows\\System32\\taskkill.exe"	2026-07-18_0df0d21b93d8857864be8b58d0173257_akira_rusty-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Windows\\System32\\taskkill.exe"	2026-07-18_0df0d21b93d8857864be8b58d0173257_akira_rusty-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "C:\\Windows\\System32\\taskkill.exe"	2026-07-18_0df0d21b93d8857864be8b58d0173257_akira_rusty-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\control.exe	2026-07-18_0df0d21b93d8857864be8b58d0173257_akira_rusty-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	2026-07-18_0df0d21b93d8857864be8b58d0173257_akira_rusty-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\resmon.exe	2026-07-18_0df0d21b93d8857864be8b58d0173257_akira_rusty-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\resmon.exe\Debugger = "C:\\Windows\\System32\\taskkill.exe"	2026-07-18_0df0d21b93d8857864be8b58d0173257_akira_rusty-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\control.exe	2026-07-18_0df0d21b93d8857864be8b58d0173257_akira_rusty-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\resmon.exe\Debugger = "C:\\Windows\\System32\\taskkill.exe"	2026-07-18_0df0d21b93d8857864be8b58d0173257_akira_rusty-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe	2026-07-18_0df0d21b93d8857864be8b58d0173257_akira_rusty-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\control.exe\Debugger = "C:\\Windows\\System32\\taskkill.exe"	2026-07-18_0df0d21b93d8857864be8b58d0173257_akira_rusty-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-18_0df0d21b93d8857864be8b58d0173257_akira_rusty-stealer.exe"	2026-07-18_0df0d21b93d8857864be8b58d0173257_akira_rusty-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\control.exe\Debugger = "C:\\Windows\\System32\\taskkill.exe"	2026-07-18_0df0d21b93d8857864be8b58d0173257_akira_rusty-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logonui.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-18_0df0d21b93d8857864be8b58d0173257_akira_rusty-stealer.exe"	2026-07-18_0df0d21b93d8857864be8b58d0173257_akira_rusty-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\resmon.exe	2026-07-18_0df0d21b93d8857864be8b58d0173257_akira_rusty-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	2026-07-18_0df0d21b93d8857864be8b58d0173257_akira_rusty-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	2026-07-18_0df0d21b93d8857864be8b58d0173257_akira_rusty-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logonui.exe	2026-07-18_0df0d21b93d8857864be8b58d0173257_akira_rusty-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	2026-07-18_0df0d21b93d8857864be8b58d0173257_akira_rusty-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-18_0df0d21b93d8857864be8b58d0173257_akira_rusty-stealer.exe"	2026-07-18_0df0d21b93d8857864be8b58d0173257_akira_rusty-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Windows\\System32\\taskkill.exe"	2026-07-18_0df0d21b93d8857864be8b58d0173257_akira_rusty-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logonui.exe	2026-07-18_0df0d21b93d8857864be8b58d0173257_akira_rusty-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logonui.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-18_0df0d21b93d8857864be8b58d0173257_akira_rusty-stealer.exe"	2026-07-18_0df0d21b93d8857864be8b58d0173257_akira_rusty-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe	2026-07-18_0df0d21b93d8857864be8b58d0173257_akira_rusty-stealer.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
4108	taskkill.exe
4064	taskkill.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4108	taskkill.exe
Token: SeDebugPrivilege	4064	taskkill.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5220 wrote to memory of 4108	5220	2026-07-18_0df0d21b93d8857864be8b58d0173257_akira_rusty-stealer.exe	90
PID 5220 wrote to memory of 1284	5220	2026-07-18_0df0d21b93d8857864be8b58d0173257_akira_rusty-stealer.exe	92
PID 1284 wrote to memory of 4064	1284	2026-07-18_0df0d21b93d8857864be8b58d0173257_akira_rusty-stealer.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-07-18_0df0d21b93d8857864be8b58d0173257_akira_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_0df0d21b93d8857864be8b58d0173257_akira_rusty-stealer.exe"
1⤵
- Disables RegEdit via registry modification
- Event Triggered Execution: Image File Execution Options Injection
- Suspicious use of WriteProcessMemory
PID:5220
- C:\Windows\system32\taskkill.exe
  "taskkill" /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4108
- C:\Users\Admin\AppData\Local\Temp\2026-07-18_0df0d21b93d8857864be8b58d0173257_akira_rusty-stealer.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-18_0df0d21b93d8857864be8b58d0173257_akira_rusty-stealer.exe" --silent-files
  2⤵
  - Disables RegEdit via registry modification
  - Event Triggered Execution: Image File Execution Options Injection
  - Suspicious use of WriteProcessMemory
  PID:1284
- - C:\Windows\system32\taskkill.exe
    "taskkill" /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Image File Execution Options Injection

1

T1546.012

Privilege Escalation

Event Triggered Execution

1

T1546

Image File Execution Options Injection

1

T1546.012

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.locker_user

Path C:\Windows\Temp\.locker_user
Size 5B
SHA256 c1c224b03cd9bc7b6a86d77f5dace40191766c485cd55dc48caf9ac873335d6f
MD5 e3afed0047b08059d0fada10f400c1e5
SHA1 4e7afebcfbae000b22c7c85e5560f89a2a0280b4
SHA512 887375daec62a9f02d32a63c9e14c7641a9a8a42e4fa8f6590eb928d9744b57bb5057a1d227e4d40ef911ac030590bbce2bfdb78103ff0b79094cee8425601f5
MD5 SHA1 SHA512

Submit Download

archive_Admin.zip

Path C:\archive_Admin.zip
Size 9.7MB
SHA256 9a9ebe5ef0faffc18def197f9389ffe660dbf26b1d263c04d508a81abe06f82e
MD5 869afb1aff5477e520047854a59b5b4e
SHA1 f91eaa35accd865db310fe96921f9afb79cb0c77
SHA512 a523933c36c45ad93aaa6829844742c6cc2bc764cd0e479961ffd54cca0a8031eba3d9e758de727677912870327ab622dffd901dc39379f477557f983b292a5e
SSDEEP 196608:s6YRJPs/F+b/dlDYWXo4VkICVGo58hu52HhzlD0lXkYX1C:s6Es/Qb/dlBX/Vkt558hY2BlYxl1C
TLSH
T174A6333E2E4274A8E2E6E970223CB7FC8F1205026FDE59F80C58E57D617617D4A294DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads