Overview

overview

10

Static

static

3

2026-04-18...rm.exe

windows10-2004-x64

10

2026-04-18...rm.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    18/04/2026, 04:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-18_1e559932ec0795c93065031d304bc2d0_akira_elex_glassworm.exe
  • Size 8.1MB
  • Sample260418-e5dy6sgw6w
  • SHA256 2ae58c0f767ea76b811140d93ee5255fa88bf699e48ae419a9fda44100315433
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdefense_evasiondiscoverysalatstealerspywarestealertrojanupx

Malware Config

Signatures

  • Family: salatstealer

    SalatStealer is a stealer that takes sceenshot written in Golang.

    stealersalatstealer
  • Detect SalatStealer payload 50 IoCs
  • UAC bypass 3 TTPs 1 IoCs
    defense_evasiontrojan
  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 50 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 50 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 50 IoCs
  • UPX dump on OEP (original entry point) 63 IoCs
  • Badlisted process makes network request 9 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Executes dropped EXE 10 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Drops file in System32 directory 2 IoCs
  • UPX packed file 63 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 8 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-18_1e559932ec0795c93065031d304bc2d0_akira_elex_glassworm.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-18_1e559932ec0795c93065031d304bc2d0_akira_elex_glassworm.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2148
    • C:\Users\Admin\AppData\Local\Temp\GpuService_8db501.exe
      "C:\Users\Admin\AppData\Local\Temp\GpuService_8db501.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4716
      • C:\Users\Admin\AppData\Local\Google\SppExtComObj.Exe
        C:\Users\Admin\AppData\Local\Google\SppExtComObj.Exe
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1516
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe
          4⤵
          • Badlisted process makes network request
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1888
        • C:\Program Files\Google\Chrome\Application\SppExtComObj.Exe
          "C:\Program Files\Google\Chrome\Application\SppExtComObj.Exe" -
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2496
        • C:\Program Files (x86)\Microsoft\Edge\Application\SppExtComObj.Exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\SppExtComObj.Exe" -
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4140
    • C:\Users\Admin\AppData\Local\D3DSCache\csrss.exe
      C:\Users\Admin\AppData\Local\D3DSCache\csrss.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4740
      • C:\Users\Admin\AppData\Local\Temp\GpuService_8db501.exe
        "C:\Users\Admin\AppData\Local\Temp\GpuService_8db501.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1940
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe
        3⤵
        • UAC bypass
        • Badlisted process makes network request
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2764
        • C:\Windows\SysWOW64\ReAgentc.exe
          "C:\Windows\system32\ReAgentc.exe" /disable
          4⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:4028
      • C:\Program Files\Google\Chrome\Application\csrss.exe
        "C:\Program Files\Google\Chrome\Application\csrss.exe" -
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1620
        • C:\Users\Admin\AppData\Local\Temp\GpuService_8db501.exe
          "C:\Users\Admin\AppData\Local\Temp\GpuService_8db501.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4924
      • C:\Program Files (x86)\Microsoft\Edge\Application\csrss.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\csrss.exe" -
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1144
        • C:\Users\Admin\AppData\Local\Temp\GpuService_8db501.exe
          "C:\Users\Admin\AppData\Local\Temp\GpuService_8db501.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3372
  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
    1⤵
      PID:2644
    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
      1⤵
        PID:2284
      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
        1⤵
          PID:3200
        • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
          "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
          1⤵
            PID:2740
          • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
            "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
            1⤵
              PID:4836
            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
              1⤵
                PID:4376

              Network

                    MITRE ATT&CK Enterprise v16

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    svc_ae75f19a.log
                    • Path C:\ProgramData\svc_ae75f19a.log
                    • Size 1KB
                    • SHA256 d00def6577ad83f01fde25ee35163a635a58a6acca1243c50405e1ad730a9775
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    svc_ae75f19a.log
                    • Path C:\ProgramData\svc_ae75f19a.log
                    • Size 1KB
                    • SHA256 84803826e3cff160fce5204145f38f965ff67af27856ea4aada6493bdf42e9e9
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    svc_ae75f19a.log
                    • Path C:\ProgramData\svc_ae75f19a.log
                    • Size 2KB
                    • SHA256 a0f7719c04cd04429dba1953b591c020dfe15e05626bf4ea64b915e409f6e6e3
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    svc_ae75f19a.log
                    • Path C:\ProgramData\svc_ae75f19a.log
                    • Size 2KB
                    • SHA256 3b99f83b641f9d304a1bd3f15043960ea401d6542f59a3d6da572ff1778ccd05
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    svc_ae75f19a.log
                    • Path C:\ProgramData\svc_ae75f19a.log
                    • Size 2KB
                    • SHA256 49f04a7afee9bc8014769928677a7c2f6b3384388e98903114403bfe6f570a96
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    svc_ae75f19a.log
                    • Path C:\ProgramData\svc_ae75f19a.log
                    • Size 2KB
                    • SHA256 abe7212d53079c420545072296abd3267cc2f5a6efe1d859196dfe6c4919ea54
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    svc_ae75f19a.log
                    • Path C:\ProgramData\svc_ae75f19a.log
                    • Size 3KB
                    • SHA256 e2dca215ef41096327e73f97aa194be5924be486dbb30969b9335ec675813336
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    svc_ae75f19a.log
                    • Path C:\ProgramData\svc_ae75f19a.log
                    • Size 1KB
                    • SHA256 68505e30dc3f5870a24b2292db11699ad25f6196664930da954ab3c79fd767ae
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    csrss.exe
                    • Path C:\Users\Admin\AppData\Local\D3DSCache\csrss.exe
                    • Size 8.1MB
                    • SHA256 2ae58c0f767ea76b811140d93ee5255fa88bf699e48ae419a9fda44100315433
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    powershell.exe.log
                    • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                    • Size 2KB
                    • SHA256 4b358073a71db50c1124e49776946f403d5a6ad555b8f86331ed8510f41ee7ae
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-Interactive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                    • Size 19KB
                    • SHA256 050b942509d6760e7e187e3760e12f4be7b1180006b60aa2cb233085abb3f483
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    612470685
                    • Path C:\Users\Admin\AppData\Local\Temp\612470685
                    • Size 138KB
                    • SHA256 149c1a433e3a72d2b816d4136fc02404b2288ccfa8521cd6b156321489cb8e67
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    GpuService_8db501.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\GpuService_8db501.exe
                    • Size 3.4MB
                    • SHA256 145e75c7e55b58a5167488fa514544a66a7f864474fa8f8b016de0aa29457ca3
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    __PSScriptPolicyTest_nvixhvlb.3ab.ps1
                    • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nvixhvlb.3ab.ps1
                    • Size 60B
                    • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    memory/1144-298-0x0000000004000000-0x0000000004C62000-memory.dmp
                    Download

                    memory/1144-316-0x00000000005D0000-0x0000000000DE5000-memory.dmp
                    Download

                    memory/1144-312-0x0000000004000000-0x0000000004C62000-memory.dmp
                    Download

                    memory/1144-311-0x0000000004000000-0x0000000004C62000-memory.dmp
                    Download

                    memory/1144-310-0x0000000004000000-0x0000000004C62000-memory.dmp
                    Download

                    memory/1144-309-0x0000000004000000-0x0000000004C62000-memory.dmp
                    Download

                    memory/1144-314-0x0000000004000000-0x0000000004C62000-memory.dmp
                    Download

                    memory/1144-308-0x0000000004000000-0x0000000004C62000-memory.dmp
                    Download

                    memory/1516-121-0x0000000000F20000-0x0000000001B76000-memory.dmp
                    Download

                    memory/1516-61-0x0000000000F20000-0x0000000001B76000-memory.dmp
                    Download

                    memory/1516-323-0x0000000000F20000-0x0000000001B76000-memory.dmp
                    Download

                    memory/1516-332-0x0000000000F20000-0x0000000001B76000-memory.dmp
                    Download

                    memory/1516-334-0x0000000000F20000-0x0000000001B76000-memory.dmp
                    Download

                    memory/1516-278-0x0000000000F20000-0x0000000001B76000-memory.dmp
                    Download

                    memory/1516-342-0x0000000000F20000-0x0000000001B76000-memory.dmp
                    Download

                    memory/1516-340-0x0000000000F20000-0x0000000001B76000-memory.dmp
                    Download

                    memory/1516-338-0x0000000000F20000-0x0000000001B76000-memory.dmp
                    Download

                    memory/1516-119-0x0000000000F20000-0x0000000001B76000-memory.dmp
                    Download

                    memory/1516-336-0x0000000000F20000-0x0000000001B76000-memory.dmp
                    Download

                    memory/1620-244-0x0000000003C00000-0x0000000004862000-memory.dmp
                    Download

                    memory/1620-241-0x0000000003C00000-0x0000000004862000-memory.dmp
                    Download

                    memory/1620-238-0x0000000003C00000-0x0000000004862000-memory.dmp
                    Download

                    memory/1620-240-0x0000000003C00000-0x0000000004862000-memory.dmp
                    Download

                    memory/1620-231-0x0000000003C00000-0x0000000004862000-memory.dmp
                    Download

                    memory/1620-239-0x0000000003C00000-0x0000000004862000-memory.dmp
                    Download

                    memory/1620-242-0x0000000003C00000-0x0000000004862000-memory.dmp
                    Download

                    memory/1620-246-0x0000000000220000-0x0000000000A35000-memory.dmp
                    Download

                    memory/1888-166-0x0000000008140000-0x00000000081D6000-memory.dmp
                    Download

                    memory/1888-138-0x00000000065B0000-0x0000000006907000-memory.dmp
                    Download

                    memory/1888-140-0x0000000006AC0000-0x0000000006B0C000-memory.dmp
                    Download

                    memory/1888-330-0x0000000003110000-0x0000000003123000-memory.dmp
                    Download

                    memory/1888-331-0x0000000005A10000-0x0000000005A25000-memory.dmp
                    Download

                    memory/1888-149-0x0000000007020000-0x0000000007066000-memory.dmp
                    Download

                    memory/1888-139-0x0000000006A60000-0x0000000006A7E000-memory.dmp
                    Download

                    memory/1888-152-0x0000000007EA0000-0x0000000007ED4000-memory.dmp
                    Download

                    memory/1888-161-0x0000000007EE0000-0x0000000007EFE000-memory.dmp
                    Download

                    memory/1888-154-0x0000000070640000-0x0000000070997000-memory.dmp
                    Download

                    memory/1888-153-0x0000000070450000-0x000000007049C000-memory.dmp
                    Download

                    memory/1888-162-0x0000000007F00000-0x0000000007FA4000-memory.dmp
                    Download

                    memory/1888-164-0x0000000008030000-0x000000000804A000-memory.dmp
                    Download

                    memory/1888-163-0x0000000008670000-0x0000000008CEA000-memory.dmp
                    Download

                    memory/1888-165-0x0000000008080000-0x000000000808A000-memory.dmp
                    Download

                    memory/1888-129-0x0000000005BB0000-0x0000000005BD2000-memory.dmp
                    Download

                    memory/1888-167-0x00000000080A0000-0x00000000080B1000-memory.dmp
                    Download

                    memory/1888-168-0x00000000080E0000-0x00000000080EE000-memory.dmp
                    Download

                    memory/1888-169-0x00000000080F0000-0x0000000008105000-memory.dmp
                    Download

                    memory/1888-170-0x0000000008200000-0x000000000821A000-memory.dmp
                    Download

                    memory/1888-171-0x00000000081E0000-0x00000000081E8000-memory.dmp
                    Download

                    memory/1888-172-0x0000000008210000-0x0000000008232000-memory.dmp
                    Download

                    memory/1888-173-0x00000000092A0000-0x0000000009846000-memory.dmp
                    Download

                    memory/1888-306-0x0000000003110000-0x0000000003123000-memory.dmp
                    Download

                    memory/1888-307-0x0000000005A10000-0x0000000005A25000-memory.dmp
                    Download

                    memory/1888-128-0x0000000005C00000-0x000000000622A000-memory.dmp
                    Download

                    memory/1888-131-0x0000000006540000-0x00000000065A6000-memory.dmp
                    Download

                    memory/1888-126-0x0000000003150000-0x0000000003186000-memory.dmp
                    Download

                    memory/1888-130-0x00000000062A0000-0x0000000006306000-memory.dmp
                    Download

                    memory/1940-93-0x0000000000690000-0x00000000012E6000-memory.dmp
                    Download

                    memory/1940-91-0x0000000000690000-0x00000000012E6000-memory.dmp
                    Download

                    memory/2148-64-0x00000000040A0000-0x0000000004D02000-memory.dmp
                    Download

                    memory/2148-40-0x00000000040A0000-0x0000000004D02000-memory.dmp
                    Download

                    memory/2148-30-0x00000000040A0000-0x0000000004D02000-memory.dmp
                    Download

                    memory/2148-37-0x00000000040A0000-0x0000000004D02000-memory.dmp
                    Download

                    memory/2148-38-0x00000000040A0000-0x0000000004D02000-memory.dmp
                    Download

                    memory/2148-42-0x00000000040A0000-0x0000000004D02000-memory.dmp
                    Download

                    memory/2148-43-0x00000000040A0000-0x0000000004D02000-memory.dmp
                    Download

                    memory/2148-39-0x00000000040A0000-0x0000000004D02000-memory.dmp
                    Download

                    memory/2148-41-0x00000000040A0000-0x0000000004D02000-memory.dmp
                    Download

                    memory/2148-45-0x0000000000DF0000-0x0000000001605000-memory.dmp
                    Download

                    memory/2148-47-0x00000000040A0000-0x0000000004D02000-memory.dmp
                    Download

                    memory/2148-69-0x00000000040A0000-0x0000000004D02000-memory.dmp
                    Download

                    memory/2148-87-0x0000000000DF0000-0x0000000001605000-memory.dmp
                    Download

                    memory/2496-127-0x0000000000BD0000-0x0000000001826000-memory.dmp
                    Download

                    memory/2496-142-0x0000000000BD0000-0x0000000001826000-memory.dmp
                    Download

                    memory/2764-283-0x0000000002430000-0x0000000002443000-memory.dmp
                    Download

                    memory/2764-211-0x0000000070640000-0x0000000070997000-memory.dmp
                    Download

                    memory/2764-284-0x0000000004EB0000-0x0000000004EC5000-memory.dmp
                    Download

                    memory/2764-210-0x0000000070450000-0x000000007049C000-memory.dmp
                    Download

                    memory/3372-280-0x00000000008A0000-0x00000000014F6000-memory.dmp
                    Download

                    memory/3372-277-0x00000000008A0000-0x00000000014F6000-memory.dmp
                    Download

                    memory/4140-148-0x0000000000790000-0x00000000013E6000-memory.dmp
                    Download

                    memory/4140-151-0x0000000000790000-0x00000000013E6000-memory.dmp
                    Download

                    memory/4716-46-0x0000000000190000-0x0000000000DE6000-memory.dmp
                    Download

                    memory/4716-17-0x0000000000190000-0x0000000000DE6000-memory.dmp
                    Download

                    memory/4716-63-0x0000000000190000-0x0000000000DE6000-memory.dmp
                    Download

                    memory/4716-49-0x0000000000190000-0x0000000000DE6000-memory.dmp
                    Download

                    memory/4716-44-0x0000000000190000-0x0000000000DE6000-memory.dmp
                    Download

                    memory/4740-117-0x0000000003E00000-0x0000000004A62000-memory.dmp
                    Download

                    memory/4740-120-0x00000000004C0000-0x0000000000CD5000-memory.dmp
                    Download

                    memory/4740-107-0x0000000003E00000-0x0000000004A62000-memory.dmp
                    Download

                    memory/4740-174-0x0000000003E00000-0x0000000004A62000-memory.dmp
                    Download

                    memory/4740-175-0x0000000003E00000-0x0000000004A62000-memory.dmp
                    Download

                    memory/4740-115-0x0000000003E00000-0x0000000004A62000-memory.dmp
                    Download

                    memory/4740-118-0x0000000003E00000-0x0000000004A62000-memory.dmp
                    Download

                    memory/4740-114-0x0000000003E00000-0x0000000004A62000-memory.dmp
                    Download

                    memory/4740-187-0x0000000003E00000-0x0000000004A62000-memory.dmp
                    Download

                    memory/4740-116-0x0000000003E00000-0x0000000004A62000-memory.dmp
                    Download

                    memory/4740-207-0x0000000003E00000-0x0000000004A62000-memory.dmp
                    Download

                    memory/4740-176-0x0000000003E00000-0x0000000004A62000-memory.dmp
                    Download

                    memory/4924-209-0x0000000000430000-0x0000000001086000-memory.dmp
                    Download

                    memory/4924-206-0x0000000000430000-0x0000000001086000-memory.dmp
                    Download