Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/11/2026, 13:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-01_9fe96afefbd14e59340bfb64430f633c_akira_cobalt-strike_icedid_rusty-stealer.exe
Resource
win10v2004-20260911-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-01_9fe96afefbd14e59340bfb64430f633c_akira_cobalt-strike_icedid_rusty-stealer.exe
Resource
win11ltsc2024-20260911-en
0 signatures
150 seconds
General
- Target 2026-11-01_9fe96afefbd14e59340bfb64430f633c_akira_cobalt-strike_icedid_rusty-stealer.exe
- Size 902KB
- Sample261102-qjm6haww2j
- SHA256 315f7a779656cae4d3b83c0d93c801d7778266a7a197c63d0bfbe614f2eed74a
- MD5 9fe96afefbd14e59340bfb64430f633c
- SHA1 af0659f623e96d47ca9496c6516ec1780713f25c
- SHA512 1950b0e4099207cc30a4a52ef844587d1eb63ac67b22e10057e24541fb9674ac6f328dd0f090afb9e3e538c39a5b8c8240ece8508f30ad2fe73d36be2facb0c8
- SSDEEP 24576:fxIaSjH3wXDsqjnhMgeiCl7G0nehbGZpbD:fxpSjX6Dmg27RnWGj
- TLSH T1B115E026FB9558FDE526C074C346C663A9337C870B22A9EF11A415393F6BAE15F38B10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe 2026-11-01_9fe96afefbd14e59340bfb64430f633c_akira_cobalt-strike_icedid_rusty-stealer.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4464 2026-11-01_9fe96afefbd14e59340bfb64430f633c_akira_cobalt-strike_icedid_rusty-stealer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-01_9fe96afefbd14e59340bfb64430f633c_akira_cobalt-strike_icedid_rusty-stealer.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-01_9fe96afefbd14e59340bfb64430f633c_akira_cobalt-strike_icedid_rusty-stealer.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4464