Analysis
- max time kernel
150s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/09/2026, 20:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-25_c1941ccdd96bb2320f557150c43719ee_akira_cobalt-strike_icedid_rusty-stealer_ryuk.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-25_c1941ccdd96bb2320f557150c43719ee_akira_cobalt-strike_icedid_rusty-stealer_ryuk.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-09-25_c1941ccdd96bb2320f557150c43719ee_akira_cobalt-strike_icedid_rusty-stealer_ryuk.exe
- Size 642KB
- Sample260925-yx4dmshd48
- SHA256 66da8ab5528e3461a0c44c8925c33c0b1f56eb153b645d78964f8dec8b520242
- MD5 c1941ccdd96bb2320f557150c43719ee
- SHA1 b9cdf395b38b44fe709f2f7a38c07cac580d8fcd
- SHA512 0c24fdf6f17ba4c33df8322e1191f6a37c691e29e92c96f7f914853d1a11da5ca1733f9b32ee4dfe6130e11ac96cc5177bf92caea60abfb72ad67fe9463f060a
- SSDEEP 12288:aWGV6dbY77JQHJGB8QYNIplMiYtz5kztYTjH5UYJh:ajB6HJGCQUQlBzgZU0
- TLSH T1BEE4F1BDB8E324F6FE25553BCD1547D2C2A2F095A3205BEBE178447A7C82BC84D64B12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files\vortices\greutterm.pdf 2026-09-25_c1941ccdd96bb2320f557150c43719ee_akira_cobalt-strike_icedid_rusty-stealer_ryuk.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\NotificationData explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002 explorer.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3592 explorer.exe - Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeShutdownPrivilege 3592 explorer.exe Token: SeCreatePagefilePrivilege 3592 explorer.exe Token: SeShutdownPrivilege 3592 explorer.exe Token: SeCreatePagefilePrivilege 3592 explorer.exe Token: SeShutdownPrivilege 3592 explorer.exe Token: SeCreatePagefilePrivilege 3592 explorer.exe Token: SeShutdownPrivilege 3592 explorer.exe Token: SeCreatePagefilePrivilege 3592 explorer.exe Token: SeShutdownPrivilege 3592 explorer.exe Token: SeCreatePagefilePrivilege 3592 explorer.exe Token: SeShutdownPrivilege 3592 explorer.exe Token: SeCreatePagefilePrivilege 3592 explorer.exe Token: SeShutdownPrivilege 3592 explorer.exe Token: SeCreatePagefilePrivilege 3592 explorer.exe Token: SeShutdownPrivilege 3592 explorer.exe Token: SeCreatePagefilePrivilege 3592 explorer.exe Token: SeShutdownPrivilege 3592 explorer.exe Token: SeCreatePagefilePrivilege 3592 explorer.exe Token: SeShutdownPrivilege 3592 explorer.exe Token: SeCreatePagefilePrivilege 3592 explorer.exe Token: SeShutdownPrivilege 3592 explorer.exe Token: SeCreatePagefilePrivilege 3592 explorer.exe Token: SeShutdownPrivilege 3592 explorer.exe Token: SeCreatePagefilePrivilege 3592 explorer.exe Token: SeShutdownPrivilege 3592 explorer.exe Token: SeCreatePagefilePrivilege 3592 explorer.exe Token: SeShutdownPrivilege 3592 explorer.exe Token: SeCreatePagefilePrivilege 3592 explorer.exe Token: SeShutdownPrivilege 3592 explorer.exe Token: SeCreatePagefilePrivilege 3592 explorer.exe Token: SeShutdownPrivilege 3592 explorer.exe Token: SeCreatePagefilePrivilege 3592 explorer.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1364 2026-09-25_c1941ccdd96bb2320f557150c43719ee_akira_cobalt-strike_icedid_rusty-stealer_ryuk.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1364 wrote to memory of 3592 1364 2026-09-25_c1941ccdd96bb2320f557150c43719ee_akira_cobalt-strike_icedid_rusty-stealer_ryuk.exe 82
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\2026-09-25_c1941ccdd96bb2320f557150c43719ee_akira_cobalt-strike_icedid_rusty-stealer_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-25_c1941ccdd96bb2320f557150c43719ee_akira_cobalt-strike_icedid_rusty-stealer_ryuk.exe"2⤵
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1364
-