Overview

overview

9

Static

static

1

2026-04-26...rm.exe

windows10-2004-x64

9

2026-04-26...rm.exe

windows11-21h2-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    26/04/2026, 12:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-26_d1435b1788a6346a434ddcadc03b9b83_akira_amadey_blankgrabber_elex_glassworm.exe
  • Size 172.6MB
  • Sample260426-plefpsdv4n
  • SHA256 fff29ab84b96a9938209fba427f269098e803b524730080f75d537da97c93e9d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
discovery

Malware Config

Signatures

  • Detects executables manipulated with Fody 1 IoCs
  • Downloads MZ/PE file 1 IoCs
  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

    discovery
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 29 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 57 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-26_d1435b1788a6346a434ddcadc03b9b83_akira_amadey_blankgrabber_elex_glassworm.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-26_d1435b1788a6346a434ddcadc03b9b83_akira_amadey_blankgrabber_elex_glassworm.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4396
    • C:\Users\Admin\AppData\Local\osulazer\current\osu!.exe
      "C:\Users\Admin\AppData\Local\osulazer\current\osu!.exe" --veloapp-install 2026.425.0-lazer
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:3908
    • C:\Users\Admin\AppData\Local\osulazer\current\osu!.exe
      "C:\Users\Admin\AppData\Local\osulazer\current\osu!.exe"
      2⤵
      • Downloads MZ/PE file
      • Checks computer location settings
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4936
  • C:\Windows\System32\GameBarPresenceWriter.exe
    "C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
    1⤵
    • Network Service Discovery
    PID:4216
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1708
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
    1⤵
    • Checks processor information in registry
    • Modifies registry class
    PID:4656

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Microsoft.Win32.Primitives.dll
        • Path C:\Users\Admin\AppData\Local\osulazer\current\Microsoft.Win32.Primitives.dll
        • Size 15KB
        • SHA256 50e52f74a18cf64efd7e3635c4489264a39207b221c69180999371c5597d899b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NuGet.Versioning.dll
        • Path C:\Users\Admin\AppData\Local\osulazer\current\NuGet.Versioning.dll
        • Size 63KB
        • SHA256 bfcba996b3fc59fbee4d67ae42cc86acae455cbe55119216cda2b84b4457256f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Realm.dll
        • Path C:\Users\Admin\AppData\Local\osulazer\current\Realm.dll
        • Size 369KB
        • SHA256 8e4fb132732386025d3a4f2676036ab45b414561cdb2e9d1c9635ea0f4b6ffe3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SDL3-CS.dll
        • Path C:\Users\Admin\AppData\Local\osulazer\current\SDL3-CS.dll
        • Size 352KB
        • SHA256 cfcc1f45b23be966ea8d70aeb8682220527ea949987a380bb14c7b44b3508e4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Sentry.dll
        • Path C:\Users\Admin\AppData\Local\osulazer\current\Sentry.dll
        • Size 814KB
        • SHA256 0392e55989fccc26d8eedbfdaa2255c92f15bf266b37e79a2dd44fddd53af0e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Collections.Immutable.dll
        • Path C:\Users\Admin\AppData\Local\osulazer\current\System.Collections.Immutable.dll
        • Size 818KB
        • SHA256 1d94d76703ccef97ff962d60701c10009bb83b2ed65b5f4f28c8535adf17ecbc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Collections.NonGeneric.dll
        • Path C:\Users\Admin\AppData\Local\osulazer\current\System.Collections.NonGeneric.dll
        • Size 102KB
        • SHA256 8a4845d14b6c46234a34b4ff1fa9ee0eb157339928b58e708212daca68048294
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Collections.dll
        • Path C:\Users\Admin\AppData\Local\osulazer\current\System.Collections.dll
        • Size 254KB
        • SHA256 43f1812c74be62e65bb6e232d2a61a24f1ad732d014ed5adc6fe1f13e454de8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.ComponentModel.Primitives.dll
        • Path C:\Users\Admin\AppData\Local\osulazer\current\System.ComponentModel.Primitives.dll
        • Size 78KB
        • SHA256 719473d4afdabd721abe970b1f2bf20e40f3e447da6d0b784a579badb82b5a50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Diagnostics.Process.dll
        • Path C:\Users\Admin\AppData\Local\osulazer\current\System.Diagnostics.Process.dll
        • Size 330KB
        • SHA256 03abe0088509b77206a19d3a1f57fb4fad654cc21a57a7f342520936c05dcf32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Linq.dll
        • Path C:\Users\Admin\AppData\Local\osulazer\current\System.Linq.dll
        • Size 530KB
        • SHA256 02640836e88e14fa8f85c90141d2cbcebf2919c2d8681123e9c309b92df8449e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Memory.dll
        • Path C:\Users\Admin\AppData\Local\osulazer\current\System.Memory.dll
        • Size 154KB
        • SHA256 cb69cadc77e09c964dd7c07151c0297ca33ccc617de68386abc66dd782c8d2a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.ObjectModel.dll
        • Path C:\Users\Admin\AppData\Local\osulazer\current\System.ObjectModel.dll
        • Size 78KB
        • SHA256 934a1b87711d9ff84f44956ef4e5436ad615bbd2b62f1d96fe0e2676723a3113
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Private.CoreLib.dll
        • Path C:\Users\Admin\AppData\Local\osulazer\current\System.Private.CoreLib.dll
        • Size 12.6MB
        • SHA256 bac6c78c3a7a6998cd045204950f4572dc0d837b570bf032ec8551c31b4ae4e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Private.Uri.dll
        • Path C:\Users\Admin\AppData\Local\osulazer\current\System.Private.Uri.dll
        • Size 254KB
        • SHA256 b762dfa0e052d5fd9fd05309b4ae9e03d6ae46f262b620cfaad961a6070ef7fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Private.Xml.Linq.dll
        • Path C:\Users\Admin\AppData\Local\osulazer\current\System.Private.Xml.Linq.dll
        • Size 394KB
        • SHA256 0b8e738deb443240a61ed5cd488bb5c3c1c798d6bab6372b804d82997db2e35b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Private.Xml.dll
        • Path C:\Users\Admin\AppData\Local\osulazer\current\System.Private.Xml.dll
        • Size 7.6MB
        • SHA256 2ef8cce40566cfec7afc2d171495e7b26b96a5ea13f66647bcf2d0bb45beb955
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Runtime.InteropServices.dll
        • Path C:\Users\Admin\AppData\Local\osulazer\current\System.Runtime.InteropServices.dll
        • Size 94KB
        • SHA256 7c53e031183b36fe378205ac894b1ddc41bca992393b153c7e68b951dc14f657
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Runtime.dll
        • Path C:\Users\Admin\AppData\Local\osulazer\current\System.Runtime.dll
        • Size 42KB
        • SHA256 55242c750d5817ab526ab17be00a604d88458c49001eb520c0538194a9a46f26
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Text.Encoding.Extensions.dll
        • Path C:\Users\Admin\AppData\Local\osulazer\current\System.Text.Encoding.Extensions.dll
        • Size 15KB
        • SHA256 038082536705e63ff31a8f0038f3f87601d347c6f71d4dfa99a5bbb7f78ef2c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Threading.Thread.dll
        • Path C:\Users\Admin\AppData\Local\osulazer\current\System.Threading.Thread.dll
        • Size 15KB
        • SHA256 61d68e044876e5f4767c8d77c2d2be15fc292478e4f6a1833546613771f24d0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Threading.dll
        • Path C:\Users\Admin\AppData\Local\osulazer\current\System.Threading.dll
        • Size 82KB
        • SHA256 72e11fd27c4e00cf5f1b78d009bc782d4d594a9d149f9c455c067f0be7f38f4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Xml.ReaderWriter.dll
        • Path C:\Users\Admin\AppData\Local\osulazer\current\System.Xml.ReaderWriter.dll
        • Size 21KB
        • SHA256 0ec354529c989e708b71db0813fcf0835a4be1deeac0a18be2c0f655d2ea6758
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Xml.XDocument.dll
        • Path C:\Users\Admin\AppData\Local\osulazer\current\System.Xml.XDocument.dll
        • Size 15KB
        • SHA256 4a06159cedc51469dff4a78ff572e4581faea83a966649a24b7ebf9e759005d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Velopack.dll
        • Path C:\Users\Admin\AppData\Local\osulazer\current\Velopack.dll
        • Size 273KB
        • SHA256 e22cec14ed28cb6c030555cd930d18a88b1a547c74cb384cda75db51be00f6b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        clrjit.dll
        • Path C:\Users\Admin\AppData\Local\osulazer\current\clrjit.dll
        • Size 1.7MB
        • SHA256 a59d248e2f2b0d4695b562e6c318d1668ae5175ede185c874ac94bb023439230
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        coreclr.dll
        • Path C:\Users\Admin\AppData\Local\osulazer\current\coreclr.dll
        • Size 4.3MB
        • SHA256 625ab4fed17ab5dea35a01fbd37de15448dede5160339d2ebc9e6653ea8281c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        hostfxr.dll
        • Path C:\Users\Admin\AppData\Local\osulazer\current\hostfxr.dll
        • Size 358KB
        • SHA256 6030fa4943ff98b4d29787c1b3045a98d4fd03dd644a3de223f0aac2ed984b3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        hostpolicy.dll
        • Path C:\Users\Admin\AppData\Local\osulazer\current\hostpolicy.dll
        • Size 397KB
        • SHA256 d6fd9ce40c9e2ff31f552313773b8c870249fe8e5f0140808a2bd26a238afcb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mscorlib.dll
        • Path C:\Users\Admin\AppData\Local\osulazer\current\mscorlib.dll
        • Size 58KB
        • SHA256 314ce67a1b2b08ed5b5e70bad1724efd5797e45d7cbfbfd757089afb64812d8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        netstandard.dll
        • Path C:\Users\Admin\AppData\Local\osulazer\current\netstandard.dll
        • Size 98KB
        • SHA256 44e97c5183223e1460f6bd2526b6df6b3e7bdef19d11a262c2404d7f7b2f0158
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        osu!.deps.json
        • Path C:\Users\Admin\AppData\Local\osulazer\current\osu!.deps.json
        • Size 208KB
        • SHA256 cadeaf97e5aafd428c60ff4dc8fe946a35af841b8418bf7df23a43ee1e054dd5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        osu!.dll
        • Path C:\Users\Admin\AppData\Local\osulazer\current\osu!.dll
        • Size 244KB
        • SHA256 4790d8b82610586cf9a4df916bc8643453a71e2f2c8a5ccc5a587a296a7d534d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        osu!.exe
        • Path C:\Users\Admin\AppData\Local\osulazer\current\osu!.exe
        • Size 239KB
        • SHA256 42b0f68987385f05ecd23d43b0225f40c6502f4771dfc551c174d4bfc242f7e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        osu!.runtimeconfig.json
        • Path C:\Users\Admin\AppData\Local\osulazer\current\osu!.runtimeconfig.json
        • Size 412B
        • SHA256 9d2837ddad683f5ddf213389b072938e935f0c1f896f931fc6656e89e605349a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        osu.Framework.dll
        • Path C:\Users\Admin\AppData\Local\osulazer\current\osu.Framework.dll
        • Size 3.8MB
        • SHA256 e2da4fdad2c8ba40802ffc58af65ef4c4af50976822f801d731c744658dfbb87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        osu.Game.Auth.dll
        • Path C:\Users\Admin\AppData\Local\osulazer\current\osu.Game.Auth.dll
        • Size 237KB
        • SHA256 595b839f57c5de9b47c937c4fe267815b1ed55fb3f12fc7a5a4a39d6d41e9969
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        osu.Game.Tournament.dll
        • Path C:\Users\Admin\AppData\Local\osulazer\current\osu.Game.Tournament.dll
        • Size 227KB
        • SHA256 3dde9df7667f66637801e5d80430d25a799667ec424806747415794a1a94dc0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        osu.Game.dll
        • Path C:\Users\Admin\AppData\Local\osulazer\current\osu.Game.dll
        • Size 6.4MB
        • SHA256 855bfbad96e172643a1ccd85c5ab6f79e122f0bf2f739e5911a3db64c1200503
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        osuTK.dll
        • Path C:\Users\Admin\AppData\Local\osulazer\current\osuTK.dll
        • Size 6.1MB
        • SHA256 7b3225b9acf2cc95707b2033fb499c9060ebe31e933987c93c21dc9248813040
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sq.version
        • Path C:\Users\Admin\AppData\Local\osulazer\current\sq.version
        • Size 541B
        • SHA256 4e69e13bb9c3bff359ffbc884ead15dd7a0553ed7bdafbd619b2e7bd7c5045b7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        AuthNative.dll
        • Path C:\Users\Admin\AppData\Roaming\osu\AuthNative.dll
        • Size 10.2MB
        • SHA256 9ba5d929acf1f183cb4998640df28350e27133d704dc0a761b0ed6b9dcbb6a24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        a1556d0801b3a6b175dda32ef546f0ec812b400499f575c44fccbe9c67f9b1e5
        • Path C:\Users\Admin\AppData\Roaming\osu\files\a\a1\a1556d0801b3a6b175dda32ef546f0ec812b400499f575c44fccbe9c67f9b1e5
        • Size 988B
        • SHA256 a1556d0801b3a6b175dda32ef546f0ec812b400499f575c44fccbe9c67f9b1e5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        1777206362.runtime.log
        • Path C:\Users\Admin\AppData\Roaming\osu\logs\1777206362.runtime.log
        • Size 10KB
        • SHA256 c3be10ceb95e1ec3989069f6a6e113c54750cd3463d64c88cc3c764a3bd5bd5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4396-469-0x000000000DA00000-0x000000000DFB3000-memory.dmp
        Download

        memory/4936-507-0x00007FF9B5670000-0x00007FF9B60AD000-memory.dmp
        Download

        memory/4936-714-0x00007FF9B5670000-0x00007FF9B60AD000-memory.dmp
        Download