Analysis
- max time kernel
148s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/09/2026, 17:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-25_f7b2f90781c797701bedd52748209ea7_akira_cobalt-strike_icedid_rusty-stealer_ryuk_satacom.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-25_f7b2f90781c797701bedd52748209ea7_akira_cobalt-strike_icedid_rusty-stealer_ryuk_satacom.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-09-25_f7b2f90781c797701bedd52748209ea7_akira_cobalt-strike_icedid_rusty-stealer_ryuk_satacom.exe
- Size 637KB
- Sample260925-vl1xlasz4m
- SHA256 040cfbf765c7fa78ae099c6cbb5e6d03e6c65270d5dee136ee251310a402692d
- MD5 f7b2f90781c797701bedd52748209ea7
- SHA1 22f74cc47ef5d3c7d5236a28ba0401a2ab014714
- SHA512 b95940005d77bc6172360ab598276116096802581f97b43c13d700c311dba56986d8fa623f9f59cbca3858cdadad5dc6a832ea4bb9b5bddc828c18517bde24f3
- SSDEEP 12288:bF91nyPh+c+U9b2t5jav45vlXsz0LFqc8BcbSlddNo:bF9d3U4Ht5vl+0qc6ml
- TLSH T148D4F13BB2A424FBE13096BB46911193A7E7F8998720D7E79A69360C2C53DDC4F39710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\uonsingoech.inf 2026-09-25_f7b2f90781c797701bedd52748209ea7_akira_cobalt-strike_icedid_rusty-stealer_ryuk_satacom.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4312 explorer.exe - Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeShutdownPrivilege 4312 explorer.exe Token: SeCreatePagefilePrivilege 4312 explorer.exe Token: SeShutdownPrivilege 4312 explorer.exe Token: SeCreatePagefilePrivilege 4312 explorer.exe Token: SeShutdownPrivilege 4312 explorer.exe Token: SeCreatePagefilePrivilege 4312 explorer.exe Token: SeShutdownPrivilege 4312 explorer.exe Token: SeCreatePagefilePrivilege 4312 explorer.exe Token: SeShutdownPrivilege 4312 explorer.exe Token: SeCreatePagefilePrivilege 4312 explorer.exe Token: SeShutdownPrivilege 4312 explorer.exe Token: SeCreatePagefilePrivilege 4312 explorer.exe Token: SeShutdownPrivilege 4312 explorer.exe Token: SeCreatePagefilePrivilege 4312 explorer.exe Token: SeShutdownPrivilege 4312 explorer.exe Token: SeCreatePagefilePrivilege 4312 explorer.exe Token: SeShutdownPrivilege 4312 explorer.exe Token: SeCreatePagefilePrivilege 4312 explorer.exe Token: SeShutdownPrivilege 4312 explorer.exe Token: SeCreatePagefilePrivilege 4312 explorer.exe Token: SeShutdownPrivilege 4312 explorer.exe Token: SeCreatePagefilePrivilege 4312 explorer.exe Token: SeShutdownPrivilege 4312 explorer.exe Token: SeCreatePagefilePrivilege 4312 explorer.exe Token: SeShutdownPrivilege 4312 explorer.exe Token: SeCreatePagefilePrivilege 4312 explorer.exe Token: SeShutdownPrivilege 4312 explorer.exe Token: SeCreatePagefilePrivilege 4312 explorer.exe Token: SeShutdownPrivilege 4312 explorer.exe Token: SeCreatePagefilePrivilege 4312 explorer.exe Token: SeShutdownPrivilege 4312 explorer.exe Token: SeCreatePagefilePrivilege 4312 explorer.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3552 2026-09-25_f7b2f90781c797701bedd52748209ea7_akira_cobalt-strike_icedid_rusty-stealer_ryuk_satacom.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3552 wrote to memory of 4312 3552 2026-09-25_f7b2f90781c797701bedd52748209ea7_akira_cobalt-strike_icedid_rusty-stealer_ryuk_satacom.exe 82
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\2026-09-25_f7b2f90781c797701bedd52748209ea7_akira_cobalt-strike_icedid_rusty-stealer_ryuk_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-25_f7b2f90781c797701bedd52748209ea7_akira_cobalt-strike_icedid_rusty-stealer_ryuk_satacom.exe"2⤵
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3552
-