2732af95e0733e14978a9e3ccd5e7f0a429a3584f0206cb57ead5e8b95737097

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_3f5578d83bfaf7990d206a301cb0e36d_akira_rusty-stealer.exe
Size 1.0MB
Sample260804-pg389szeqe
SHA256 2732af95e0733e14978a9e3ccd5e7f0a429a3584f0206cb57ead5e8b95737097
MD5 3f5578d83bfaf7990d206a301cb0e36d
SHA1 e1b814a6ff13905060caa255f81c042197b3bbc4
SHA512 f775573b2df2d99047cabcdabd084d02a084331b96c19ccc947951c4312fc6dd740dec163500b052902080903ea3cb2f9b2437072a46e12b498ac2d2b52b3095
SSDEEP 12288:stqUZPdA4rofHVMotxOS5o1hTPCSHsjCkHaGZbcXkXke0iO/7Msat6F91:Cla1j5IhTIjrrbckke09TMsa
TLSH
T144355C03F69680F8C09DC4B4831A9777AA32B8C90725BAEF17D45B212F69FA45F2D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5996	ntoskrnls.exe
3216	ntoskrnls.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\ntoskrnls.exe	2026-08-03_3f5578d83bfaf7990d206a301cb0e36d_akira_rusty-stealer.exe
File opened for modification	C:\Windows\System32\ntoskrnls.exe	attrib.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4504	cmd.exe
3352	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5184	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4092	schtasks.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4336 wrote to memory of 4504	4336	2026-08-03_3f5578d83bfaf7990d206a301cb0e36d_akira_rusty-stealer.exe	91
PID 4504 wrote to memory of 4092	4504	cmd.exe	93
PID 4336 wrote to memory of 2632	4336	2026-08-03_3f5578d83bfaf7990d206a301cb0e36d_akira_rusty-stealer.exe	94
PID 4336 wrote to memory of 3352	4336	2026-08-03_3f5578d83bfaf7990d206a301cb0e36d_akira_rusty-stealer.exe	96
PID 3352 wrote to memory of 5184	3352	cmd.exe	98
PID 3352 wrote to memory of 3216	3352	cmd.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2632	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-03_3f5578d83bfaf7990d206a301cb0e36d_akira_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_3f5578d83bfaf7990d206a301cb0e36d_akira_rusty-stealer.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /f /sc onlogon /rl highest /tn \"ntoskrnls\" /tr '\"C:\Windows\System32\ntoskrnls.exe\"'"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4504
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn \"ntoskrnls\" /tr '\"C:\Windows\System32\ntoskrnls.exe\"'
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4092
- C:\Windows\system32\attrib.exe
  "attrib" +h C:\Windows\System32\ntoskrnls.exe
  2⤵
  - Drops file in System32 directory
  - Views/modifies file attributes
  PID:2632
- C:\Windows\system32\cmd.exe
  cmd.exe /e:ON /v:OFF /d /c ""C:\Users\Admin\AppData\Local\Temp\r.bat""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3352
- - C:\Windows\system32\timeout.exe
    timeout /t 3
    3⤵
    - Delays execution with timeout.exe
    PID:5184
- - C:\Windows\System32\ntoskrnls.exe
    "C:\Windows\System32\ntoskrnls.exe"
    3⤵
    - Executes dropped EXE
    PID:3216

C:\Windows\System32\ntoskrnls.exe
""C:\Windows\System32\ntoskrnls.exe""
1⤵
- Executes dropped EXE
PID:5996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

r.bat

Path C:\Users\Admin\AppData\Local\Temp\r.bat
Size 91B
SHA256 55b2330fb923920d22fc6bde62a3be7afbbc864606e7c4ae97bd43c65efecc08
MD5 1c02f4f6447498ecf0d0108f2af39dfe
SHA1 6d2b4b9bfa7f9ebe9076402267443db78fee738c
SHA512 eb6efc53c4d3363cffa0bffd2cd35ee478e0e9a6fb43ab6cdd7dbc785b9aaa5be043e8a37e671320fde53b37d4dc0355bb03efcf0cfc2dc2306963a6b895682e
TLSH
T15BB024014745544053511C4010CF5371F30DF0CF0C00D450F04534D4CD4701DD455CCC
MD5 SHA1 SHA512 TLSH

Submit Download

ntoskrnls.exe

Path C:\Windows\System32\ntoskrnls.exe
Size 1.0MB
SHA256 2732af95e0733e14978a9e3ccd5e7f0a429a3584f0206cb57ead5e8b95737097
MD5 3f5578d83bfaf7990d206a301cb0e36d
SHA1 e1b814a6ff13905060caa255f81c042197b3bbc4
SHA512 f775573b2df2d99047cabcdabd084d02a084331b96c19ccc947951c4312fc6dd740dec163500b052902080903ea3cb2f9b2437072a46e12b498ac2d2b52b3095
SSDEEP 12288:stqUZPdA4rofHVMotxOS5o1hTPCSHsjCkHaGZbcXkXke0iO/7Msat6F91:Cla1j5IhTIjrrbckke09TMsa
TLSH
T144355C03F69680F8C09DC4B4831A9777AA32B8C90725BAEF17D45B212F69FA45F2D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3216-8-0x00000233D2950000-0x00000233D2D5A000-memory.dmp

Download

memory/4336-3-0x0000022695AE0000-0x0000022695EEA000-memory.dmp

Download

memory/5996-7-0x000002C5DC420000-0x000002C5DC82A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads