Analysis
- max time kernel
149s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
22/10/2026, 20:31
General
- Target 2026-10-21_7ae57d11a5df6458650e632a7252140c_akira_cobalt-strike_icedid_rusty-stealer_ryuk.exe
- Size 626KB
- Sample261022-zaqppstyew
- SHA256 064316475ed1ad46bf2133a07ea986a9964cabe85ea3110f6a37ffad614a24a9
Malware Config
Signatures
- Drops file in Program Files directory 3 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\2026-10-21_7ae57d11a5df6458650e632a7252140c_akira_cobalt-strike_icedid_rusty-stealer_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-21_7ae57d11a5df6458650e632a7252140c_akira_cobalt-strike_icedid_rusty-stealer_ryuk.exe"2⤵
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3280-1-0x0000000002F60000-0x0000000002FD0000-memory.dmp
memory/3280-3-0x0000000002F60000-0x0000000002FD0000-memory.dmp
memory/3280-0-0x0000000002F60000-0x0000000002FD0000-memory.dmp
memory/3280-4-0x0000000002F60000-0x0000000002FD0000-memory.dmp
memory/3280-6-0x0000000002E50000-0x0000000002E60000-memory.dmp
memory/3280-7-0x0000000002E50000-0x0000000002E60000-memory.dmp
memory/3280-9-0x00007FFFB8FD2000-0x00007FFFB8FD3000-memory.dmp
memory/3280-8-0x0000000002E50000-0x0000000002E60000-memory.dmp
memory/3280-10-0x00007FFFB8F30000-0x00007FFFB9037000-memory.dmp
memory/3280-11-0x0000000002E50000-0x0000000002E60000-memory.dmp
memory/3280-14-0x0000000002E50000-0x0000000002E60000-memory.dmp
memory/3280-13-0x0000000002E50000-0x0000000002E60000-memory.dmp
memory/3280-12-0x0000000002E50000-0x0000000002E60000-memory.dmp
memory/3280-16-0x00007FFFB8F30000-0x00007FFFB9037000-memory.dmp
memory/3280-15-0x00007FFFB8F30000-0x00007FFFB9037000-memory.dmp
memory/3280-17-0x00007FFFB8F30000-0x00007FFFB9037000-memory.dmp
memory/3280-18-0x00007FFFB8F30000-0x00007FFFB9037000-memory.dmp
memory/3280-19-0x0000000002E50000-0x0000000002E60000-memory.dmp
memory/3280-20-0x00007FFFB8F30000-0x00007FFFB9037000-memory.dmp
memory/3280-27-0x00007FFFB8F30000-0x00007FFFB9037000-memory.dmp
memory/3280-26-0x0000000002E50000-0x0000000002E60000-memory.dmp
memory/3280-31-0x00007FFFB8F30000-0x00007FFFB9037000-memory.dmp
memory/3280-30-0x00007FFFB8F30000-0x00007FFFB9037000-memory.dmp
memory/3280-29-0x00007FFFB8F30000-0x00007FFFB9037000-memory.dmp
memory/3280-28-0x00007FFFB8F30000-0x00007FFFB9037000-memory.dmp
memory/3280-25-0x0000000002E50000-0x0000000002E60000-memory.dmp
memory/3280-35-0x0000000002E50000-0x0000000002E60000-memory.dmp
memory/3280-34-0x0000000002E50000-0x0000000002E60000-memory.dmp
memory/3280-33-0x0000000002E50000-0x0000000002E60000-memory.dmp
memory/3280-32-0x0000000002E50000-0x0000000002E60000-memory.dmp
memory/3280-24-0x0000000002E50000-0x0000000002E60000-memory.dmp
memory/3280-23-0x0000000002E50000-0x0000000002E60000-memory.dmp
memory/3280-22-0x0000000002E50000-0x0000000002E60000-memory.dmp
memory/3280-21-0x0000000002E50000-0x0000000002E60000-memory.dmp
memory/3280-36-0x00007FFFB8F30000-0x00007FFFB9037000-memory.dmp
memory/3280-38-0x00007FFFB8F30000-0x00007FFFB9037000-memory.dmp
memory/3280-37-0x0000000002E50000-0x0000000002E60000-memory.dmp
memory/3280-40-0x00007FFFB8F30000-0x00007FFFB9037000-memory.dmp
memory/3280-39-0x0000000002E50000-0x0000000002E60000-memory.dmp
memory/3280-41-0x0000000002E50000-0x0000000002E60000-memory.dmp
memory/3280-44-0x0000000002E50000-0x0000000002E60000-memory.dmp
memory/3280-43-0x0000000002E50000-0x0000000002E60000-memory.dmp
memory/3280-42-0x0000000002E50000-0x0000000002E60000-memory.dmp
memory/3280-46-0x00007FFFB8F30000-0x00007FFFB9037000-memory.dmp
memory/3280-45-0x00007FFFB8F30000-0x00007FFFB9037000-memory.dmp
memory/3280-47-0x00007FFFB8F30000-0x00007FFFB9037000-memory.dmp
memory/3280-48-0x0000000002E50000-0x0000000002E60000-memory.dmp
memory/3280-49-0x00007FFFB8F30000-0x00007FFFB9037000-memory.dmp
memory/3280-54-0x0000000002E50000-0x0000000002E60000-memory.dmp
memory/3280-53-0x0000000002E50000-0x0000000002E60000-memory.dmp
memory/3280-55-0x00007FFFB8F30000-0x00007FFFB9037000-memory.dmp
memory/3280-52-0x0000000002E50000-0x0000000002E60000-memory.dmp
memory/3280-51-0x0000000002E50000-0x0000000002E60000-memory.dmp
memory/3280-50-0x0000000002E50000-0x0000000002E60000-memory.dmp
memory/3280-57-0x0000000002E50000-0x0000000002E60000-memory.dmp
memory/3280-58-0x0000000002E50000-0x0000000002E60000-memory.dmp
memory/3280-56-0x00007FFFB8F30000-0x00007FFFB9037000-memory.dmp
memory/3280-59-0x0000000002E50000-0x0000000002E60000-memory.dmp
memory/3280-60-0x0000000002E50000-0x0000000002E60000-memory.dmp
memory/3280-61-0x00007FFFB8F30000-0x00007FFFB9037000-memory.dmp