2321fa5456141b4e8b5e230d33a7449b25c426b8bc4135366be26ab954938df1

Analysis

max time kernel
149s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 22:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_4cce62b60334167c3ae2c3c6de49c1c5_akira_rusty-stealer.exe
Size 244KB
Sample260729-2pe8matgnb
SHA256 2321fa5456141b4e8b5e230d33a7449b25c426b8bc4135366be26ab954938df1
MD5 4cce62b60334167c3ae2c3c6de49c1c5
SHA1 c0a7b1094d8190db9c662f6695d05196624a5393
SHA512 0fbda6ad886ef6fcc27bfe491837e19f27c6d4ec34188cd0d2a16b0b60a096c5e075422bff35b0e0369c19e541a47e06ea2e545368f6ad7701122f3a75983e90
SSDEEP 6144:TYzInAAlT2Am3At9hNWYMI/cBXxfhC+OVDp45:T5L7urhfw4
TLSH
T1593459253E559CB8E49BC47483058AA3597274DA0B32EDFF01D052392F6AAF97F3C618
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4412	powershell.exe
2464	powershell.exe
3920	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5380	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5380	cmd.exe
1192	PING.EXE

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
6120	taskkill.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
2396	reg.exe
4988	reg.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1192	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2464	powershell.exe
2464	powershell.exe
4412	powershell.exe
4412	powershell.exe
3920	powershell.exe
3920	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2464	powershell.exe
Token: SeDebugPrivilege	6120	taskkill.exe
Token: SeDebugPrivilege	4412	powershell.exe
Token: SeDebugPrivilege	3920	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3528 wrote to memory of 2464	3528	2026-07-29_4cce62b60334167c3ae2c3c6de49c1c5_akira_rusty-stealer.exe	88
PID 3528 wrote to memory of 6120	3528	2026-07-29_4cce62b60334167c3ae2c3c6de49c1c5_akira_rusty-stealer.exe	91
PID 3528 wrote to memory of 4988	3528	2026-07-29_4cce62b60334167c3ae2c3c6de49c1c5_akira_rusty-stealer.exe	94
PID 3528 wrote to memory of 2396	3528	2026-07-29_4cce62b60334167c3ae2c3c6de49c1c5_akira_rusty-stealer.exe	96
PID 3528 wrote to memory of 5852	3528	2026-07-29_4cce62b60334167c3ae2c3c6de49c1c5_akira_rusty-stealer.exe	98
PID 3528 wrote to memory of 4412	3528	2026-07-29_4cce62b60334167c3ae2c3c6de49c1c5_akira_rusty-stealer.exe	100
PID 3528 wrote to memory of 5380	3528	2026-07-29_4cce62b60334167c3ae2c3c6de49c1c5_akira_rusty-stealer.exe	102
PID 3528 wrote to memory of 3920	3528	2026-07-29_4cce62b60334167c3ae2c3c6de49c1c5_akira_rusty-stealer.exe	103
PID 5380 wrote to memory of 1192	5380	cmd.exe	105

C:\Users\Admin\AppData\Local\Temp\2026-07-29_4cce62b60334167c3ae2c3c6de49c1c5_akira_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_4cce62b60334167c3ae2c3c6de49c1c5_akira_rusty-stealer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "[System.Reflection.Assembly]::LoadWithPartialName('System.Windows.Forms') | Out-Null; $r = [System.Windows.Forms.MessageBox]::Show('Удалить NEXUS v2? Папка: C:\Users\Admin\AppData\Local\NEXUS v2 Все сохранённые профили и настройки будут удалены. Это действие нельзя отменить.', 'NEXUS v2 Uninstall', 'YesNo', 'Question'); if ($r -eq 'Yes') { exit 0 } else { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2464
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM nexusV2.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6120
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Classes\.nexus /f
  2⤵
  - Modifies registry key
  PID:4988
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Classes\nexus /f
  2⤵
  - Modifies registry key
  PID:2396
- C:\Windows\system32\reg.exe
  "reg" delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\NEXUS v2" /f
  2⤵
  PID:5852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "[Win32]::SHChangeNotify(0x08000000, 0, 0, 0) > $null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4412
- C:\Windows\system32\cmd.exe
  "cmd" /C "ping 127.0.0.1 -n 3 >nul & del /f /q \"C:\Users\Admin\AppData\Local\Temp\2026-07-29_4cce62b60334167c3ae2c3c6de49c1c5_akira_rusty-stealer.exe\""
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:5380
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "[System.Reflection.Assembly]::LoadWithPartialName('System.Windows.Forms') | Out-Null; [System.Windows.Forms.MessageBox]::Show('NEXUS v2 удалён.', 'NEXUS v2 Uninstall', 'OK', 'Information')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 75ec3c5c55e6fc8696942c802d3669148fb2883aad68e15e64d781c501f601c9
MD5 fdb35b2efeea97521c106ab2e4f84ca4
SHA1 2359a1123364c1865746de2a03cbd23fe01feead
SHA512 35ccd8d6789a0e25be448dba9f0b288b65e9d2ef5bf0d9a176e27b71ac28c5da902d0520da61e8116e8554dabb456b82b49d357fdb481cb83436e029d7429b80
TLSH
T15D115B73B3CD8214D859403660CEE92037B587DB50AFCE577B84D118F83F599CEA0260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 952B
SHA256 061c379001e8446603527639dff25200df906aa927eb9a0198f057311b0907de
MD5 6fe8bba3ffa999e7565cc8892628367b
SHA1 7640dfa5f988061879854c40a7edae15af98adf1
SHA512 165e84370c42459b79ae7eba30ecb1eb142df6150fca8db0b367e642c59d815b5041c4831b85afbdb059719287a3252eebc59a8c4f4691540c80279807c9c584
TLSH
T1FA114433F3CC86A4DC59403650DEAC1136B78BCB409EDE9B6B84C155A46F685CEA1260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_wwfc04p1.xw0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wwfc04p1.xw0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2464-8-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp

Download

memory/2464-6-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp

Download

memory/2464-7-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp

Download

memory/2464-0-0x00007FFA7686F000-0x00007FFA76870000-memory.dmp

Download

memory/2464-9-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp

Download

memory/2464-10-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp

Download

memory/2464-11-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp

Download

memory/2464-13-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp

Download

memory/2464-5-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp

Download

memory/2464-3-0x0000020975E90000-0x0000020975EB2000-memory.dmp

Download

memory/2464-4-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp

Download