099b9c64fe38e6d9e857f681ca1d3befedc62991fbf994525220fe38f9901e34

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 03:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_1530662d7e0555cd90a1e70c5dcc64be_akira_cobalt-strike_glassworm_icedid_rusty-stealer.exe
Size 998KB
Sample260810-dhv4hatyft
SHA256 099b9c64fe38e6d9e857f681ca1d3befedc62991fbf994525220fe38f9901e34
MD5 1530662d7e0555cd90a1e70c5dcc64be
SHA1 fb05dd54e48d7cababd20a93b2c1562a425b2ac5
SHA512 a626533e1118508a9ab7c61144b5f7d71a9d6901dfddab855bf577e4278119aba3c025e819f7b6b16ba447081aa73f2c56e65a85d3d6120ee5eacd1b7c585957
SSDEEP 12288:8BOcmyrjNrgGtUX61VEiDQLuiPlpx+JkmKLDXaE2HJOMGMARny:8BjHASVPQLuiPlimLD2JO/t
TLSH
T169256B03E69585FCD95EC078C7669532AA33B89E0B30B5EF6AD42B143E27E915F2D301
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion persistence privilege_escalation spyware stealer

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4196	netsh.exe

Executes dropped EXE 1 IoCs

pid	Process
1680	schost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 1680	4140	2026-08-10_1530662d7e0555cd90a1e70c5dcc64be_akira_cobalt-strike_glassworm_icedid_rusty-stealer.exe	89
PID 1680 wrote to memory of 4196	1680	schost.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-10_1530662d7e0555cd90a1e70c5dcc64be_akira_cobalt-strike_glassworm_icedid_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_1530662d7e0555cd90a1e70c5dcc64be_akira_cobalt-strike_glassworm_icedid_rusty-stealer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\schost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\schost.exe" --worker
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1680
- - C:\Windows\system32\netsh.exe
    "netsh" advfirewall firewall add rule "name=Windows Host Process" dir=in program=C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\schost.exe action=allow enable=yes profile=any
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

schost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\schost.exe
Size 998KB
SHA256 099b9c64fe38e6d9e857f681ca1d3befedc62991fbf994525220fe38f9901e34
MD5 1530662d7e0555cd90a1e70c5dcc64be
SHA1 fb05dd54e48d7cababd20a93b2c1562a425b2ac5
SHA512 a626533e1118508a9ab7c61144b5f7d71a9d6901dfddab855bf577e4278119aba3c025e819f7b6b16ba447081aa73f2c56e65a85d3d6120ee5eacd1b7c585957
SSDEEP 12288:8BOcmyrjNrgGtUX61VEiDQLuiPlpx+JkmKLDXaE2HJOMGMARny:8BjHASVPQLuiPlimLD2JO/t
TLSH
T169256B03E69585FCD95EC078C7669532AA33B89E0B30B5EF6AD42B143E27E915F2D301
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads