Analysis
- max time kernel
150s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/09/2026, 15:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-29_dd2d341ee0dfd7b44b035928195d0a50_akira_cobalt-strike_icedid_rusty-stealer_ryuk_satacom.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-29_dd2d341ee0dfd7b44b035928195d0a50_akira_cobalt-strike_icedid_rusty-stealer_ryuk_satacom.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-09-29_dd2d341ee0dfd7b44b035928195d0a50_akira_cobalt-strike_icedid_rusty-stealer_ryuk_satacom.exe
- Size 637KB
- Sample260929-smygratbph
- SHA256 fe9728d00f5af519b7ca6536da09cdc7cd9b9b82362268e7e4da4ec281511f29
- MD5 dd2d341ee0dfd7b44b035928195d0a50
- SHA1 727903a65e4d3bb6ee9fa25b9ca587967297e13f
- SHA512 ad75341149f108e5176042a9f892c506a945d619624fcc09135fc5ab1aa0ac6bb29818792e1164f6c79c823099339837332772cc80dafb18e694171bf5c30d36
- SSDEEP 12288:Vmbrh16mxejz+iPmwDvCrH/3MH87CJ3j/seIQQ6wQJE4h/PLcMTQ:Vm516Fq2QUHwCJ3j/p1QhaEALcMTQ
- TLSH T14AD4E139F2E9D0E8E265597B9669D1148472F0D5CB322AEF0610A3322F717C8DE3DB19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files\vacates\schiigeuch.dat 2026-09-29_dd2d341ee0dfd7b44b035928195d0a50_akira_cobalt-strike_icedid_rusty-stealer_ryuk_satacom.exe File opened for modification C:\Program Files\irons\iachiump.dat 2026-09-29_dd2d341ee0dfd7b44b035928195d0a50_akira_cobalt-strike_icedid_rusty-stealer_ryuk_satacom.exe File opened for modification C:\Program Files (x86)\Verbatim\sceaucyuesm.pdf 2026-09-29_dd2d341ee0dfd7b44b035928195d0a50_akira_cobalt-strike_icedid_rusty-stealer_ryuk_satacom.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\NotificationData explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002 explorer.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4928 explorer.exe - Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeShutdownPrivilege 4928 explorer.exe Token: SeCreatePagefilePrivilege 4928 explorer.exe Token: SeShutdownPrivilege 4928 explorer.exe Token: SeCreatePagefilePrivilege 4928 explorer.exe Token: SeShutdownPrivilege 4928 explorer.exe Token: SeCreatePagefilePrivilege 4928 explorer.exe Token: SeShutdownPrivilege 4928 explorer.exe Token: SeCreatePagefilePrivilege 4928 explorer.exe Token: SeShutdownPrivilege 4928 explorer.exe Token: SeCreatePagefilePrivilege 4928 explorer.exe Token: SeShutdownPrivilege 4928 explorer.exe Token: SeCreatePagefilePrivilege 4928 explorer.exe Token: SeShutdownPrivilege 4928 explorer.exe Token: SeCreatePagefilePrivilege 4928 explorer.exe Token: SeShutdownPrivilege 4928 explorer.exe Token: SeCreatePagefilePrivilege 4928 explorer.exe Token: SeShutdownPrivilege 4928 explorer.exe Token: SeCreatePagefilePrivilege 4928 explorer.exe Token: SeShutdownPrivilege 4928 explorer.exe Token: SeCreatePagefilePrivilege 4928 explorer.exe Token: SeShutdownPrivilege 4928 explorer.exe Token: SeCreatePagefilePrivilege 4928 explorer.exe Token: SeShutdownPrivilege 4928 explorer.exe Token: SeCreatePagefilePrivilege 4928 explorer.exe Token: SeShutdownPrivilege 4928 explorer.exe Token: SeCreatePagefilePrivilege 4928 explorer.exe Token: SeShutdownPrivilege 4928 explorer.exe Token: SeCreatePagefilePrivilege 4928 explorer.exe Token: SeShutdownPrivilege 4928 explorer.exe Token: SeCreatePagefilePrivilege 4928 explorer.exe Token: SeShutdownPrivilege 4928 explorer.exe Token: SeCreatePagefilePrivilege 4928 explorer.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4548 2026-09-29_dd2d341ee0dfd7b44b035928195d0a50_akira_cobalt-strike_icedid_rusty-stealer_ryuk_satacom.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4548 wrote to memory of 4928 4548 2026-09-29_dd2d341ee0dfd7b44b035928195d0a50_akira_cobalt-strike_icedid_rusty-stealer_ryuk_satacom.exe 81
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_dd2d341ee0dfd7b44b035928195d0a50_akira_cobalt-strike_icedid_rusty-stealer_ryuk_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_dd2d341ee0dfd7b44b035928195d0a50_akira_cobalt-strike_icedid_rusty-stealer_ryuk_satacom.exe"2⤵
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4548
-