Analysis
- max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 08:05
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-10_d7143e94db9692292a1fa448c9761502_akira_coinminer_rusty-stealer.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_d7143e94db9692292a1fa448c9761502_akira_coinminer_rusty-stealer.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-08-10_d7143e94db9692292a1fa448c9761502_akira_coinminer_rusty-stealer.exe
- Size 921KB
- Sample260810-jzcldadn8w
- SHA256 18c73fb58a65ef856bcdfd8b2cca78328d3f3981b38b934a237a5e3fe5757d01
- MD5 d7143e94db9692292a1fa448c9761502
- SHA1 3d1ec4e3da5cadb51ad0a6757652cd84013c7e14
- SHA512 0acce87602ac51b0cef2d7ca9e3b48cba4081ab6bbfa3b61c149409eee9063b03a195e7753572e390559d7b1c23d5e08eff0278474c92cc0800763dc2081fbca
- SSDEEP 12288:K82l/PD0DOWC7fL4NjjznFOGkQO1Xend0HXpdqnrg53aoo:3QoRC7D6jzFbKf+S3Y
- TLSH T191154C07BA6594E8D5ABC43CC6574526AA2274DB0B31A7EF12C51A1D3F26BF4AF3C300
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables referencing many IR and analysis tools 1 IoCs
resource yara_rule behavioral2/files/0x001200000001c491-0.dat INDICATOR_SUSPICIOUS_References_SecTools - Executes dropped EXE 2 IoCs
pid Process 5812 SysRuntimeMonitor.exe 3944 RuntimeBrokerHost.exe - Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 ip-api.com - Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4064 schtasks.exe 4700 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeLockMemoryPrivilege 3944 RuntimeBrokerHost.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe 3944 RuntimeBrokerHost.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2036 wrote to memory of 4064 2036 2026-08-10_d7143e94db9692292a1fa448c9761502_akira_coinminer_rusty-stealer.exe 90 PID 2036 wrote to memory of 5812 2036 2026-08-10_d7143e94db9692292a1fa448c9761502_akira_coinminer_rusty-stealer.exe 92 PID 5812 wrote to memory of 3944 5812 SysRuntimeMonitor.exe 93 PID 5812 wrote to memory of 4700 5812 SysRuntimeMonitor.exe 94 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_d7143e94db9692292a1fa448c9761502_akira_coinminer_rusty-stealer.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_d7143e94db9692292a1fa448c9761502_akira_coinminer_rusty-stealer.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\system32\schtasks.exe"schtasks" /Create /F /SC ONLOGON /TN RuntimeBroker /TR \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Security\SysRuntimeMonitor.exe\"2⤵
- Scheduled Task/Job: Scheduled Task
PID:4064
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Security\SysRuntimeMonitor.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Security\SysRuntimeMonitor.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5812 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\RuntimeBrokerHost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\RuntimeBrokerHost.exe" --internal-supervised Local\RuntimeBrokerHost-heartbeat-5812-1786349184985 Local\RuntimeBrokerHost-heartbeat-5812-1786349184985 5812 C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Security\SysRuntimeMonitor.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3944
-
-
C:\Windows\system32\schtasks.exe"schtasks" /Create /F /SC ONLOGON /TN RuntimeBroker /TR \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Security\SysRuntimeMonitor.exe\"3⤵
- Scheduled Task/Job: Scheduled Task
PID:4700
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Security\SysRuntimeMonitor.exe
- Size 921KB
- SHA256 18c73fb58a65ef856bcdfd8b2cca78328d3f3981b38b934a237a5e3fe5757d01
- MD5 d7143e94db9692292a1fa448c9761502
- SHA1 3d1ec4e3da5cadb51ad0a6757652cd84013c7e14
- SHA512 0acce87602ac51b0cef2d7ca9e3b48cba4081ab6bbfa3b61c149409eee9063b03a195e7753572e390559d7b1c23d5e08eff0278474c92cc0800763dc2081fbca
- SSDEEP 12288:K82l/PD0DOWC7fL4NjjznFOGkQO1Xend0HXpdqnrg53aoo:3QoRC7D6jzFbKf+S3Y
- TLSH T191154C07BA6594E8D5ABC43CC6574526AA2274DB0B31A7EF12C51A1D3F26BF4AF3C300
- MD5 SHA1 SHA512 SSDEEP TLSH