dac8f341d38d7b36a3146f1bd653fbfaa1129f9b3951db8dafff5f328854f55c

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 23:26

Target
2026-07-22_adb8f261b55059897cc1017beb84d5ec_akira_icedid_rusty-stealer.exe
Size 1.3MB
Sample260722-3ethyade22
SHA256 dac8f341d38d7b36a3146f1bd653fbfaa1129f9b3951db8dafff5f328854f55c
MD5 adb8f261b55059897cc1017beb84d5ec
SHA1 7b91778039349ad96625b761eb6a77ac9f8e1f72
SHA512 123108a313a1b8a004d7932240b226c95bf7e3b2c3b9a87af1d6a11c7e34f725d80248ef74066733ebe7dbc672d33d8b5db68139ae491568bbbe65daf2c61af8
SSDEEP 24576:Tay1Tc4MCJRMiep+GaGByGr+eMhgjVFM3VIH06iyvL:WOTcsJRMieftVMhg7YIU6i
TLSH
T111557D03E69581F9C0A9C4B4C3579A33EA72B88A0B34B5FF5BE057112E26F905B3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

persistence

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1021.001

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\MonitorAgent = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-22_adb8f261b55059897cc1017beb84d5ec_akira_icedid_rusty-stealer.exe\""	2026-07-22_adb8f261b55059897cc1017beb84d5ec_akira_icedid_rusty-stealer.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-22_adb8f261b55059897cc1017beb84d5ec_akira_icedid_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_adb8f261b55059897cc1017beb84d5ec_akira_icedid_rusty-stealer.exe"
1⤵
- Adds Run key to start application
PID:1860

C:\Users\Admin\AppData\Local\Temp\2026-07-22_adb8f261b55059897cc1017beb84d5ec_akira_icedid_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_adb8f261b55059897cc1017beb84d5ec_akira_icedid_rusty-stealer.exe"
1⤵
PID:3716