Analysis
- max time kernel
150s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
26/09/2026, 16:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-26_b06b48d27d9ac9ad41bee9b257f291c4_akira_cobalt-strike_icedid_rusty-stealer_ryuk.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-26_b06b48d27d9ac9ad41bee9b257f291c4_akira_cobalt-strike_icedid_rusty-stealer_ryuk.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-09-26_b06b48d27d9ac9ad41bee9b257f291c4_akira_cobalt-strike_icedid_rusty-stealer_ryuk.exe
- Size 626KB
- Sample260926-t338lsxelf
- SHA256 9d455406079de8bfa5cb82280057e2172719b51451dcdcd7a8a37d6b98c2f053
- MD5 b06b48d27d9ac9ad41bee9b257f291c4
- SHA1 ecb08f56806b1ab8efa00c330ad36f3ae669950c
- SHA512 cd3014ca8b10b0e0a844f4fafd2a362f450391c2eea85cb7cc0133323be228d4cb01053c5a49ebf176b1c8ad6c5c0d3ecc0f836d3ae61c354526420dc97974e9
- SSDEEP 12288:QJGm4NCjdPET2OHwd6IYjXB8iIHoBBBoCQE0mJCTGs7gL8wq1KdKA:QEjBDh7j/obKeRbwq1KcA
- TLSH T174D4F12BA5D208F8E06F51B7C82B019653E2F402C650AFFF1614EC6D2FA66D85EAC751
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files\Npcap\olliirly.pdf 2026-09-26_b06b48d27d9ac9ad41bee9b257f291c4_akira_cobalt-strike_icedid_rusty-stealer_ryuk.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\NotificationData explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002 explorer.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2408 explorer.exe - Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeShutdownPrivilege 2408 explorer.exe Token: SeCreatePagefilePrivilege 2408 explorer.exe Token: SeShutdownPrivilege 2408 explorer.exe Token: SeCreatePagefilePrivilege 2408 explorer.exe Token: SeShutdownPrivilege 2408 explorer.exe Token: SeCreatePagefilePrivilege 2408 explorer.exe Token: SeShutdownPrivilege 2408 explorer.exe Token: SeCreatePagefilePrivilege 2408 explorer.exe Token: SeShutdownPrivilege 2408 explorer.exe Token: SeCreatePagefilePrivilege 2408 explorer.exe Token: SeShutdownPrivilege 2408 explorer.exe Token: SeCreatePagefilePrivilege 2408 explorer.exe Token: SeShutdownPrivilege 2408 explorer.exe Token: SeCreatePagefilePrivilege 2408 explorer.exe Token: SeShutdownPrivilege 2408 explorer.exe Token: SeCreatePagefilePrivilege 2408 explorer.exe Token: SeShutdownPrivilege 2408 explorer.exe Token: SeCreatePagefilePrivilege 2408 explorer.exe Token: SeShutdownPrivilege 2408 explorer.exe Token: SeCreatePagefilePrivilege 2408 explorer.exe Token: SeShutdownPrivilege 2408 explorer.exe Token: SeCreatePagefilePrivilege 2408 explorer.exe Token: SeShutdownPrivilege 2408 explorer.exe Token: SeCreatePagefilePrivilege 2408 explorer.exe Token: SeShutdownPrivilege 2408 explorer.exe Token: SeCreatePagefilePrivilege 2408 explorer.exe Token: SeShutdownPrivilege 2408 explorer.exe Token: SeCreatePagefilePrivilege 2408 explorer.exe Token: SeShutdownPrivilege 2408 explorer.exe Token: SeCreatePagefilePrivilege 2408 explorer.exe Token: SeShutdownPrivilege 2408 explorer.exe Token: SeCreatePagefilePrivilege 2408 explorer.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5764 2026-09-26_b06b48d27d9ac9ad41bee9b257f291c4_akira_cobalt-strike_icedid_rusty-stealer_ryuk.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5764 wrote to memory of 2408 5764 2026-09-26_b06b48d27d9ac9ad41bee9b257f291c4_akira_cobalt-strike_icedid_rusty-stealer_ryuk.exe 82
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\2026-09-26_b06b48d27d9ac9ad41bee9b257f291c4_akira_cobalt-strike_icedid_rusty-stealer_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-26_b06b48d27d9ac9ad41bee9b257f291c4_akira_cobalt-strike_icedid_rusty-stealer_ryuk.exe"2⤵
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5764
-