Analysis
- max time kernel
148s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/10/2026, 21:42
General
- Target 2026-10-22_0f68e884bdcf92b067a4ae02449ba7fb_akira_rusty-stealer.exe
- Size 8.5MB
- Sample261024-1kldeass4r
- SHA256 6702a4715a13e94f61f7b777e00e3d195de7a169c0e466ee9ba4a92a521667f8
Malware Config
Signatures
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 6 IoCs
- Downloads MZ/PE file 8 IoCs
- Modifies RDP port number used by Windows 1 TTPs
- Executes dropped EXE 1 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_0f68e884bdcf92b067a4ae02449ba7fb_akira_rusty-stealer.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_0f68e884bdcf92b067a4ae02449ba7fb_akira_rusty-stealer.exe"1⤵
- Downloads MZ/PE file
- Reads the TCP/IP host and domain name from the registry
-
C:\ProgramData\SystemCertificates\0ff7d86db514bc12\ZillberReleyHost.exeC:\ProgramData\SystemCertificates\0ff7d86db514bc12\ZillberReleyHost.exe /c1⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
1
GROUP
INSTALL_TIME
index.dat
REMARK
ZillberReleyHost.exe
B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D
B76BE66D46C355931939D8CF818D03FD_68DC46933CF3DE41CC968E0784D43DC3
B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D
B76BE66D46C355931939D8CF818D03FD_68DC46933CF3DE41CC968E0784D43DC3
B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
Rpcrt4_dll_5828_1792878167068399400.dll
advapi32_dll_5828_1792878167070141800.dll
kernel32_dll_5828_1792878167064925900.dll
ntdll_dll_5828_1792878167068399400.dll
sdc_2392_1792878160960364900.tmp
sdc_5828_1792878168855450900.tmp
sdc_5828_1792878169539222300.tmp
sdc
memory/2392-34-0x00007FFB11CA0000-0x00007FFB11DB6000-memory.dmp
memory/2392-26-0x00007FFB11560000-0x00007FFB11627000-memory.dmp
memory/2392-44-0x00007FFB12340000-0x00007FFB125A3000-memory.dmp
memory/2392-40-0x00007FFB10420000-0x00007FFB104D2000-memory.dmp
memory/5828-1556-0x0000022ACE8A0000-0x0000022ACE94E000-memory.dmp
memory/5828-1525-0x00007FFB11560000-0x00007FFB11627000-memory.dmp
memory/5828-1549-0x00007FFB12340000-0x00007FFB125A3000-memory.dmp
memory/5828-1543-0x00007FFB11CA0000-0x00007FFB11DB6000-memory.dmp
memory/5828-1550-0x0000022ACD500000-0x0000022ACD505000-memory.dmp
memory/5828-1540-0x00007FFB10420000-0x00007FFB104D2000-memory.dmp
memory/5828-1580-0x0000022ACE8A0000-0x0000022ACE94E000-memory.dmp
memory/5828-1584-0x0000022ACE8A0000-0x0000022ACE94E000-memory.dmp
memory/5828-1585-0x0000022ACE8A0000-0x0000022ACE94E000-memory.dmp
memory/5828-1586-0x0000022ACE8A0000-0x0000022ACE94E000-memory.dmp
memory/5828-1590-0x0000022ACE8A0000-0x0000022ACE94E000-memory.dmp