Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/10/2026, 20:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-21_7ae57d11a5df6458650e632a7252140c_akira_cobalt-strike_icedid_rusty-stealer_ryuk.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-21_7ae57d11a5df6458650e632a7252140c_akira_cobalt-strike_icedid_rusty-stealer_ryuk.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-10-21_7ae57d11a5df6458650e632a7252140c_akira_cobalt-strike_icedid_rusty-stealer_ryuk.exe
- Size 626KB
- Sample261022-zaqppstyew
- SHA256 064316475ed1ad46bf2133a07ea986a9964cabe85ea3110f6a37ffad614a24a9
- MD5 7ae57d11a5df6458650e632a7252140c
- SHA1 48b4de57466b6bd86a76194a3695368a0b820ee6
- SHA512 2589a2c77b97353bcb8edcb37b02d6175956b0c6c0e9af6ebc9ad84ed4a2b8003f4ae2bab9ff1e547a8ba910de08255a6f7af23baecfb8ee7d8e952589fc1fa1
- SSDEEP 12288:yozxlu/ROUJpVFaXhUzYXdLc66wu6cdiw/i4U0qT1zpgitCo5s:tx4jkXhUWLVLcJ/q0oti
- TLSH T15DD4E1B2F29111F4E13381378AD6549E637FFC134B6DAFDF03644A922E1A2C64E69706
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\gnomes\mcuayieurth.dat 2026-10-21_7ae57d11a5df6458650e632a7252140c_akira_cobalt-strike_icedid_rusty-stealer_ryuk.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio\fryeuntseank.inf 2026-10-21_7ae57d11a5df6458650e632a7252140c_akira_cobalt-strike_icedid_rusty-stealer_ryuk.exe File opened for modification C:\Program Files\legitimise\mquiappeld 2026-10-21_7ae57d11a5df6458650e632a7252140c_akira_cobalt-strike_icedid_rusty-stealer_ryuk.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2716 explorer.exe - Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeShutdownPrivilege 2716 explorer.exe Token: SeCreatePagefilePrivilege 2716 explorer.exe Token: SeShutdownPrivilege 2716 explorer.exe Token: SeCreatePagefilePrivilege 2716 explorer.exe Token: SeShutdownPrivilege 2716 explorer.exe Token: SeCreatePagefilePrivilege 2716 explorer.exe Token: SeShutdownPrivilege 2716 explorer.exe Token: SeCreatePagefilePrivilege 2716 explorer.exe Token: SeShutdownPrivilege 2716 explorer.exe Token: SeCreatePagefilePrivilege 2716 explorer.exe Token: SeShutdownPrivilege 2716 explorer.exe Token: SeCreatePagefilePrivilege 2716 explorer.exe Token: SeShutdownPrivilege 2716 explorer.exe Token: SeCreatePagefilePrivilege 2716 explorer.exe Token: SeShutdownPrivilege 2716 explorer.exe Token: SeCreatePagefilePrivilege 2716 explorer.exe Token: SeShutdownPrivilege 2716 explorer.exe Token: SeCreatePagefilePrivilege 2716 explorer.exe Token: SeShutdownPrivilege 2716 explorer.exe Token: SeCreatePagefilePrivilege 2716 explorer.exe Token: SeShutdownPrivilege 2716 explorer.exe Token: SeCreatePagefilePrivilege 2716 explorer.exe Token: SeShutdownPrivilege 2716 explorer.exe Token: SeCreatePagefilePrivilege 2716 explorer.exe Token: SeShutdownPrivilege 2716 explorer.exe Token: SeCreatePagefilePrivilege 2716 explorer.exe Token: SeShutdownPrivilege 2716 explorer.exe Token: SeCreatePagefilePrivilege 2716 explorer.exe Token: SeShutdownPrivilege 2716 explorer.exe Token: SeCreatePagefilePrivilege 2716 explorer.exe Token: SeShutdownPrivilege 2716 explorer.exe Token: SeCreatePagefilePrivilege 2716 explorer.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5504 2026-10-21_7ae57d11a5df6458650e632a7252140c_akira_cobalt-strike_icedid_rusty-stealer_ryuk.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5504 wrote to memory of 2716 5504 2026-10-21_7ae57d11a5df6458650e632a7252140c_akira_cobalt-strike_icedid_rusty-stealer_ryuk.exe 80
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\2026-10-21_7ae57d11a5df6458650e632a7252140c_akira_cobalt-strike_icedid_rusty-stealer_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-21_7ae57d11a5df6458650e632a7252140c_akira_cobalt-strike_icedid_rusty-stealer_ryuk.exe"2⤵
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5504
-