Analysis
- max time kernel
151s - max time network
116s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/10/2026, 10:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-02_6922b502f5fad25114261a64f7d0b061_akira_cobalt-strike_glassworm_icedid_rusty-stealer_ryuk_satacom.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-02_6922b502f5fad25114261a64f7d0b061_akira_cobalt-strike_glassworm_icedid_rusty-stealer_ryuk_satacom.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-10-02_6922b502f5fad25114261a64f7d0b061_akira_cobalt-strike_glassworm_icedid_rusty-stealer_ryuk_satacom.exe
- Size 40.9MB
- Sample261003-m26tsaytey
- SHA256 140fa0e77ff821e77b13b176f0525e8ffd55b710a2e6a471e1ee93a33014bcf8
- MD5 6922b502f5fad25114261a64f7d0b061
- SHA1 42b6fcef9c5defbd610f44697f7d14d407b79f3a
- SHA512 ba99c9c48f4395d60190b00125bf40a44bb4a752db3212969260afa2f5d1ebc3775ee4caad4ee0b33d0cd2e0efa4a310dc4fcac8767aa236ce13d45b6162bf1d
- SSDEEP 786432:14uhBtfj7jzhUSp9hOZuwdoDrCYfG1vrBQSoJ2UBswMSZWcBNW:LJfhBpEnoxuxtQZzHMSZpBNW
- TLSH T1F197331E4F7CCE7BD68D087654B9728831F16E8287A95443D3E8AC2CAE2D5465BFE1C0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\pedal\eiankeedly.pdf 2026-10-02_6922b502f5fad25114261a64f7d0b061_akira_cobalt-strike_glassworm_icedid_rusty-stealer_ryuk_satacom.exe File opened for modification C:\Program Files (x86)\festal\auempenn.pdf 2026-10-02_6922b502f5fad25114261a64f7d0b061_akira_cobalt-strike_glassworm_icedid_rusty-stealer_ryuk_satacom.exe File opened for modification C:\Program Files\veterinary\shruryuchirst 2026-10-02_6922b502f5fad25114261a64f7d0b061_akira_cobalt-strike_glassworm_icedid_rusty-stealer_ryuk_satacom.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\NotificationData explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002 explorer.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2872 explorer.exe - Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeShutdownPrivilege 2872 explorer.exe Token: SeCreatePagefilePrivilege 2872 explorer.exe Token: SeShutdownPrivilege 2872 explorer.exe Token: SeCreatePagefilePrivilege 2872 explorer.exe Token: SeShutdownPrivilege 2872 explorer.exe Token: SeCreatePagefilePrivilege 2872 explorer.exe Token: SeShutdownPrivilege 2872 explorer.exe Token: SeCreatePagefilePrivilege 2872 explorer.exe Token: SeShutdownPrivilege 2872 explorer.exe Token: SeCreatePagefilePrivilege 2872 explorer.exe Token: SeShutdownPrivilege 2872 explorer.exe Token: SeCreatePagefilePrivilege 2872 explorer.exe Token: SeShutdownPrivilege 2872 explorer.exe Token: SeCreatePagefilePrivilege 2872 explorer.exe Token: SeShutdownPrivilege 2872 explorer.exe Token: SeCreatePagefilePrivilege 2872 explorer.exe Token: SeShutdownPrivilege 2872 explorer.exe Token: SeCreatePagefilePrivilege 2872 explorer.exe Token: SeShutdownPrivilege 2872 explorer.exe Token: SeCreatePagefilePrivilege 2872 explorer.exe Token: SeShutdownPrivilege 2872 explorer.exe Token: SeCreatePagefilePrivilege 2872 explorer.exe Token: SeShutdownPrivilege 2872 explorer.exe Token: SeCreatePagefilePrivilege 2872 explorer.exe Token: SeShutdownPrivilege 2872 explorer.exe Token: SeCreatePagefilePrivilege 2872 explorer.exe Token: SeShutdownPrivilege 2872 explorer.exe Token: SeCreatePagefilePrivilege 2872 explorer.exe Token: SeShutdownPrivilege 2872 explorer.exe Token: SeCreatePagefilePrivilege 2872 explorer.exe Token: SeShutdownPrivilege 2872 explorer.exe Token: SeCreatePagefilePrivilege 2872 explorer.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4984 2026-10-02_6922b502f5fad25114261a64f7d0b061_akira_cobalt-strike_glassworm_icedid_rusty-stealer_ryuk_satacom.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4984 wrote to memory of 2872 4984 2026-10-02_6922b502f5fad25114261a64f7d0b061_akira_cobalt-strike_glassworm_icedid_rusty-stealer_ryuk_satacom.exe 79
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\2026-10-02_6922b502f5fad25114261a64f7d0b061_akira_cobalt-strike_glassworm_icedid_rusty-stealer_ryuk_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-02_6922b502f5fad25114261a64f7d0b061_akira_cobalt-strike_glassworm_icedid_rusty-stealer_ryuk_satacom.exe"2⤵
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4984
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:3184