Analysis
- max time kernel
148s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/10/2026, 20:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-01_5d5ec5cc872aeddad8c0f9b46dd73344_akira_cobalt-strike_icedid_rusty-stealer_ryuk.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-01_5d5ec5cc872aeddad8c0f9b46dd73344_akira_cobalt-strike_icedid_rusty-stealer_ryuk.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-10-01_5d5ec5cc872aeddad8c0f9b46dd73344_akira_cobalt-strike_icedid_rusty-stealer_ryuk.exe
- Size 650KB
- Sample261003-zbjmsaxajd
- SHA256 6289338325757ea59fb262861a5ff35a7845e40fd5aef70d307937e8f4158f82
- MD5 5d5ec5cc872aeddad8c0f9b46dd73344
- SHA1 01c5d75d4bfe438dd285f0941fe46b4139cf2531
- SHA512 25698fb6f75d872941cfc3213c5b5b30f888508f37f6559553e834c2a28654ce1de1b721d86c9bd3ad80fb9f1059d5bd8140885a344d5ab8430221d7e6258d54
- SSDEEP 12288:kdyfY4OcCwdZakqfRswrEi0aU6Jj/Hz1V1CnuUs0EETLGWelokd9:kdyfT7qfmsT0WDR2n/TNdO9
- TLSH T129E4F122F7EB46F9E110457F910216035BEEFC42EBA4D69705D80629FC792F8076C79A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4948 explorer.exe - Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeShutdownPrivilege 4948 explorer.exe Token: SeCreatePagefilePrivilege 4948 explorer.exe Token: SeShutdownPrivilege 4948 explorer.exe Token: SeCreatePagefilePrivilege 4948 explorer.exe Token: SeShutdownPrivilege 4948 explorer.exe Token: SeCreatePagefilePrivilege 4948 explorer.exe Token: SeShutdownPrivilege 4948 explorer.exe Token: SeCreatePagefilePrivilege 4948 explorer.exe Token: SeShutdownPrivilege 4948 explorer.exe Token: SeCreatePagefilePrivilege 4948 explorer.exe Token: SeShutdownPrivilege 4948 explorer.exe Token: SeCreatePagefilePrivilege 4948 explorer.exe Token: SeShutdownPrivilege 4948 explorer.exe Token: SeCreatePagefilePrivilege 4948 explorer.exe Token: SeShutdownPrivilege 4948 explorer.exe Token: SeCreatePagefilePrivilege 4948 explorer.exe Token: SeShutdownPrivilege 4948 explorer.exe Token: SeCreatePagefilePrivilege 4948 explorer.exe Token: SeShutdownPrivilege 4948 explorer.exe Token: SeCreatePagefilePrivilege 4948 explorer.exe Token: SeShutdownPrivilege 4948 explorer.exe Token: SeCreatePagefilePrivilege 4948 explorer.exe Token: SeShutdownPrivilege 4948 explorer.exe Token: SeCreatePagefilePrivilege 4948 explorer.exe Token: SeShutdownPrivilege 4948 explorer.exe Token: SeCreatePagefilePrivilege 4948 explorer.exe Token: SeShutdownPrivilege 4948 explorer.exe Token: SeCreatePagefilePrivilege 4948 explorer.exe Token: SeShutdownPrivilege 4948 explorer.exe Token: SeCreatePagefilePrivilege 4948 explorer.exe Token: SeShutdownPrivilege 4948 explorer.exe Token: SeCreatePagefilePrivilege 4948 explorer.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4172 2026-10-01_5d5ec5cc872aeddad8c0f9b46dd73344_akira_cobalt-strike_icedid_rusty-stealer_ryuk.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4172 wrote to memory of 4948 4172 2026-10-01_5d5ec5cc872aeddad8c0f9b46dd73344_akira_cobalt-strike_icedid_rusty-stealer_ryuk.exe 81
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\2026-10-01_5d5ec5cc872aeddad8c0f9b46dd73344_akira_cobalt-strike_icedid_rusty-stealer_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_5d5ec5cc872aeddad8c0f9b46dd73344_akira_cobalt-strike_icedid_rusty-stealer_ryuk.exe"2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4172
-