Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
21/04/2026, 04:33
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-04-21_bb8f503d6804c18534eb450b961b09d1_akira_glassworm_rusty-stealer.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 2026-04-21_bb8f503d6804c18534eb450b961b09d1_akira_glassworm_rusty-stealer.exe
- Size 6.0MB
- Sample260421-e6wklshw7p
- SHA256 63f2dddb46aff4c45280513f3ebcb8087332e2d1b38dc8e3698088a5c5692a44
- MD5 bb8f503d6804c18534eb450b961b09d1
- SHA1 8d774397e5faafa3c334a92f4f65d8ca264fafa1
- SHA512 8e54ce9cd270f267eed8fba0a5b23327dc8f085f0f5bd0faf599e4ff94443db1fb06e862a1cc3c798a33baac558232d787e7a4cdfb974d4abed66fa037b6c5e2
- SSDEEP 49152:/DxwU/2J+zHFK96s/cr96ghhpVmWdF5lG1WZs1aOF9wVVFV5C5Y4cUtV7MsAeuvT:GryDrs1gaYsMGuvncBwz+sTG3X
- TLSH T11D566C02BF8995ECC09DC474C34A4B739B72B4CB0A35B6AF059506393F6AAB41F6D358
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 5020 wmic.exe Token: SeSecurityPrivilege 5020 wmic.exe Token: SeTakeOwnershipPrivilege 5020 wmic.exe Token: SeLoadDriverPrivilege 5020 wmic.exe Token: SeSystemProfilePrivilege 5020 wmic.exe Token: SeSystemtimePrivilege 5020 wmic.exe Token: SeProfSingleProcessPrivilege 5020 wmic.exe Token: SeIncBasePriorityPrivilege 5020 wmic.exe Token: SeCreatePagefilePrivilege 5020 wmic.exe Token: SeBackupPrivilege 5020 wmic.exe Token: SeRestorePrivilege 5020 wmic.exe Token: SeShutdownPrivilege 5020 wmic.exe Token: SeDebugPrivilege 5020 wmic.exe Token: SeSystemEnvironmentPrivilege 5020 wmic.exe Token: SeRemoteShutdownPrivilege 5020 wmic.exe Token: SeUndockPrivilege 5020 wmic.exe Token: SeManageVolumePrivilege 5020 wmic.exe Token: 33 5020 wmic.exe Token: 34 5020 wmic.exe Token: 35 5020 wmic.exe Token: 36 5020 wmic.exe Token: SeIncreaseQuotaPrivilege 5020 wmic.exe Token: SeSecurityPrivilege 5020 wmic.exe Token: SeTakeOwnershipPrivilege 5020 wmic.exe Token: SeLoadDriverPrivilege 5020 wmic.exe Token: SeSystemProfilePrivilege 5020 wmic.exe Token: SeSystemtimePrivilege 5020 wmic.exe Token: SeProfSingleProcessPrivilege 5020 wmic.exe Token: SeIncBasePriorityPrivilege 5020 wmic.exe Token: SeCreatePagefilePrivilege 5020 wmic.exe Token: SeBackupPrivilege 5020 wmic.exe Token: SeRestorePrivilege 5020 wmic.exe Token: SeShutdownPrivilege 5020 wmic.exe Token: SeDebugPrivilege 5020 wmic.exe Token: SeSystemEnvironmentPrivilege 5020 wmic.exe Token: SeRemoteShutdownPrivilege 5020 wmic.exe Token: SeUndockPrivilege 5020 wmic.exe Token: SeManageVolumePrivilege 5020 wmic.exe Token: 33 5020 wmic.exe Token: 34 5020 wmic.exe Token: 35 5020 wmic.exe Token: 36 5020 wmic.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 772 wrote to memory of 5020 772 2026-04-21_bb8f503d6804c18534eb450b961b09d1_akira_glassworm_rusty-stealer.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-21_bb8f503d6804c18534eb450b961b09d1_akira_glassworm_rusty-stealer.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-21_bb8f503d6804c18534eb450b961b09d1_akira_glassworm_rusty-stealer.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Windows\System32\Wbem\wmic.exe"wmic" computersystem get manufacturer2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5020
-