Analysis
- max time kernel
149s - max time network
145s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
03/05/2026, 16:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-03_b14fbaaa4669e5a166f6ee46d5c85c02_akira_elex_glassworm.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
27 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-03_b14fbaaa4669e5a166f6ee46d5c85c02_akira_elex_glassworm.exe
Resource
win11-20260130-en
windows11-21h2-x64
26 signatures
150 seconds
General
- Target 2026-05-03_b14fbaaa4669e5a166f6ee46d5c85c02_akira_elex_glassworm.exe
- Size 19.3MB
- Sample260503-val93ahs2m
- SHA256 27f242b2de539feea3bbb36e5b31356631335cdcb9f04e51e1260a6f916f3c38
- MD5 b14fbaaa4669e5a166f6ee46d5c85c02
- SHA1 9420cbbd9a0f63c903457cdd25e8e6cd5a62b8c4
- SHA512 1fcb97699d2541670c63b8561d7130a4a32fa18c74e9952bef7ee09c14894eedb7b3e0d97f83e29be0031e8dca8385ec8ffc5919a929a6931e9eec1384a7b755
- SSDEEP 393216:7p/YkzNzNzNzNzNzNzNzNzNzNzNzNzNzn:7p/JzNzNzNzNzNzNzNzNzNzNzNzNzNzn
- TLSH T1DD17120377FDB41AEA6B97B8D4642691C525FC778C61905A31CE04AB4F879043FBC2BA
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 35 IoCs
resource yara_rule behavioral2/memory/5332-32-0x0000000003B80000-0x00000000047DA000-memory.dmp family_salatstealer behavioral2/memory/5332-35-0x0000000003B80000-0x00000000047DA000-memory.dmp family_salatstealer behavioral2/memory/5332-33-0x0000000003B80000-0x00000000047DA000-memory.dmp family_salatstealer behavioral2/memory/5332-31-0x0000000003B80000-0x00000000047DA000-memory.dmp family_salatstealer behavioral2/memory/5332-36-0x0000000003B80000-0x00000000047DA000-memory.dmp family_salatstealer behavioral2/memory/5332-38-0x0000000003B80000-0x00000000047DA000-memory.dmp family_salatstealer behavioral2/memory/5332-39-0x0000000003B80000-0x00000000047DA000-memory.dmp family_salatstealer behavioral2/memory/5332-41-0x0000000003B80000-0x00000000047DA000-memory.dmp family_salatstealer behavioral2/memory/5332-42-0x0000000003B80000-0x00000000047DA000-memory.dmp family_salatstealer behavioral2/memory/5332-50-0x0000000003B80000-0x00000000047DA000-memory.dmp family_salatstealer behavioral2/memory/3372-85-0x0000000003FE0000-0x0000000004C3A000-memory.dmp family_salatstealer behavioral2/memory/3372-88-0x0000000003FE0000-0x0000000004C3A000-memory.dmp family_salatstealer behavioral2/memory/3372-90-0x0000000003FE0000-0x0000000004C3A000-memory.dmp family_salatstealer behavioral2/memory/3372-89-0x0000000003FE0000-0x0000000004C3A000-memory.dmp family_salatstealer behavioral2/memory/3372-86-0x0000000003FE0000-0x0000000004C3A000-memory.dmp family_salatstealer behavioral2/memory/3372-87-0x0000000003FE0000-0x0000000004C3A000-memory.dmp family_salatstealer behavioral2/memory/3372-92-0x0000000003FE0000-0x0000000004C3A000-memory.dmp family_salatstealer behavioral2/memory/3372-93-0x0000000003FE0000-0x0000000004C3A000-memory.dmp family_salatstealer behavioral2/memory/3372-99-0x0000000003FE0000-0x0000000004C3A000-memory.dmp family_salatstealer behavioral2/memory/3372-100-0x0000000003FE0000-0x0000000004C3A000-memory.dmp family_salatstealer behavioral2/memory/3372-101-0x0000000003FE0000-0x0000000004C3A000-memory.dmp family_salatstealer behavioral2/memory/3372-103-0x0000000003FE0000-0x0000000004C3A000-memory.dmp family_salatstealer behavioral2/memory/2164-154-0x00000000033A0000-0x0000000003FFA000-memory.dmp family_salatstealer behavioral2/memory/2164-156-0x00000000033A0000-0x0000000003FFA000-memory.dmp family_salatstealer behavioral2/memory/2164-158-0x00000000033A0000-0x0000000003FFA000-memory.dmp family_salatstealer behavioral2/memory/2164-159-0x00000000033A0000-0x0000000003FFA000-memory.dmp family_salatstealer behavioral2/memory/2164-155-0x00000000033A0000-0x0000000003FFA000-memory.dmp family_salatstealer behavioral2/memory/2164-165-0x00000000033A0000-0x0000000003FFA000-memory.dmp family_salatstealer behavioral2/memory/2164-157-0x00000000033A0000-0x0000000003FFA000-memory.dmp family_salatstealer behavioral2/memory/6044-220-0x0000000003C80000-0x00000000048DA000-memory.dmp family_salatstealer behavioral2/memory/6044-223-0x0000000003C80000-0x00000000048DA000-memory.dmp family_salatstealer behavioral2/memory/6044-226-0x0000000003C80000-0x00000000048DA000-memory.dmp family_salatstealer behavioral2/memory/6044-224-0x0000000003C80000-0x00000000048DA000-memory.dmp family_salatstealer behavioral2/memory/6044-222-0x0000000003C80000-0x00000000048DA000-memory.dmp family_salatstealer behavioral2/memory/6044-221-0x0000000003C80000-0x00000000048DA000-memory.dmp family_salatstealer - Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 35 IoCs
resource yara_rule behavioral2/memory/5332-32-0x0000000003B80000-0x00000000047DA000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/5332-35-0x0000000003B80000-0x00000000047DA000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/5332-33-0x0000000003B80000-0x00000000047DA000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/5332-31-0x0000000003B80000-0x00000000047DA000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/5332-36-0x0000000003B80000-0x00000000047DA000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/5332-38-0x0000000003B80000-0x00000000047DA000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/5332-39-0x0000000003B80000-0x00000000047DA000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/5332-41-0x0000000003B80000-0x00000000047DA000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/5332-42-0x0000000003B80000-0x00000000047DA000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/5332-50-0x0000000003B80000-0x00000000047DA000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/3372-85-0x0000000003FE0000-0x0000000004C3A000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/3372-88-0x0000000003FE0000-0x0000000004C3A000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/3372-90-0x0000000003FE0000-0x0000000004C3A000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/3372-89-0x0000000003FE0000-0x0000000004C3A000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/3372-86-0x0000000003FE0000-0x0000000004C3A000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/3372-87-0x0000000003FE0000-0x0000000004C3A000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/3372-92-0x0000000003FE0000-0x0000000004C3A000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/3372-93-0x0000000003FE0000-0x0000000004C3A000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/3372-99-0x0000000003FE0000-0x0000000004C3A000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/3372-100-0x0000000003FE0000-0x0000000004C3A000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/3372-101-0x0000000003FE0000-0x0000000004C3A000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/3372-103-0x0000000003FE0000-0x0000000004C3A000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/2164-154-0x00000000033A0000-0x0000000003FFA000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/2164-156-0x00000000033A0000-0x0000000003FFA000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/2164-158-0x00000000033A0000-0x0000000003FFA000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/2164-159-0x00000000033A0000-0x0000000003FFA000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/2164-155-0x00000000033A0000-0x0000000003FFA000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/2164-165-0x00000000033A0000-0x0000000003FFA000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/2164-157-0x00000000033A0000-0x0000000003FFA000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/6044-220-0x0000000003C80000-0x00000000048DA000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/6044-223-0x0000000003C80000-0x00000000048DA000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/6044-226-0x0000000003C80000-0x00000000048DA000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/6044-224-0x0000000003C80000-0x00000000048DA000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/6044-222-0x0000000003C80000-0x00000000048DA000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/6044-221-0x0000000003C80000-0x00000000048DA000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs - Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 35 IoCs
resource yara_rule behavioral2/memory/5332-32-0x0000000003B80000-0x00000000047DA000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5332-35-0x0000000003B80000-0x00000000047DA000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5332-33-0x0000000003B80000-0x00000000047DA000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5332-31-0x0000000003B80000-0x00000000047DA000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5332-36-0x0000000003B80000-0x00000000047DA000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5332-38-0x0000000003B80000-0x00000000047DA000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5332-39-0x0000000003B80000-0x00000000047DA000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5332-41-0x0000000003B80000-0x00000000047DA000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5332-42-0x0000000003B80000-0x00000000047DA000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5332-50-0x0000000003B80000-0x00000000047DA000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/3372-85-0x0000000003FE0000-0x0000000004C3A000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/3372-88-0x0000000003FE0000-0x0000000004C3A000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/3372-90-0x0000000003FE0000-0x0000000004C3A000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/3372-89-0x0000000003FE0000-0x0000000004C3A000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/3372-86-0x0000000003FE0000-0x0000000004C3A000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/3372-87-0x0000000003FE0000-0x0000000004C3A000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/3372-92-0x0000000003FE0000-0x0000000004C3A000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/3372-93-0x0000000003FE0000-0x0000000004C3A000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/3372-99-0x0000000003FE0000-0x0000000004C3A000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/3372-100-0x0000000003FE0000-0x0000000004C3A000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/3372-101-0x0000000003FE0000-0x0000000004C3A000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/3372-103-0x0000000003FE0000-0x0000000004C3A000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2164-154-0x00000000033A0000-0x0000000003FFA000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2164-156-0x00000000033A0000-0x0000000003FFA000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2164-158-0x00000000033A0000-0x0000000003FFA000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2164-159-0x00000000033A0000-0x0000000003FFA000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2164-155-0x00000000033A0000-0x0000000003FFA000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2164-165-0x00000000033A0000-0x0000000003FFA000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2164-157-0x00000000033A0000-0x0000000003FFA000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/6044-220-0x0000000003C80000-0x00000000048DA000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/6044-223-0x0000000003C80000-0x00000000048DA000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/6044-226-0x0000000003C80000-0x00000000048DA000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/6044-224-0x0000000003C80000-0x00000000048DA000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/6044-222-0x0000000003C80000-0x00000000048DA000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/6044-221-0x0000000003C80000-0x00000000048DA000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers - Detects executables containing SQL queries to confidential data stores. Observed in infostealers 35 IoCs
resource yara_rule behavioral2/memory/5332-32-0x0000000003B80000-0x00000000047DA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/5332-35-0x0000000003B80000-0x00000000047DA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/5332-33-0x0000000003B80000-0x00000000047DA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/5332-31-0x0000000003B80000-0x00000000047DA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/5332-36-0x0000000003B80000-0x00000000047DA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/5332-38-0x0000000003B80000-0x00000000047DA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/5332-39-0x0000000003B80000-0x00000000047DA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/5332-41-0x0000000003B80000-0x00000000047DA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/5332-42-0x0000000003B80000-0x00000000047DA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/5332-50-0x0000000003B80000-0x00000000047DA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/3372-85-0x0000000003FE0000-0x0000000004C3A000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/3372-88-0x0000000003FE0000-0x0000000004C3A000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/3372-90-0x0000000003FE0000-0x0000000004C3A000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/3372-89-0x0000000003FE0000-0x0000000004C3A000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/3372-86-0x0000000003FE0000-0x0000000004C3A000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/3372-87-0x0000000003FE0000-0x0000000004C3A000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/3372-92-0x0000000003FE0000-0x0000000004C3A000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/3372-93-0x0000000003FE0000-0x0000000004C3A000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/3372-99-0x0000000003FE0000-0x0000000004C3A000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/3372-100-0x0000000003FE0000-0x0000000004C3A000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/3372-101-0x0000000003FE0000-0x0000000004C3A000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/3372-103-0x0000000003FE0000-0x0000000004C3A000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/2164-154-0x00000000033A0000-0x0000000003FFA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/2164-156-0x00000000033A0000-0x0000000003FFA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/2164-158-0x00000000033A0000-0x0000000003FFA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/2164-159-0x00000000033A0000-0x0000000003FFA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/2164-155-0x00000000033A0000-0x0000000003FFA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/2164-165-0x00000000033A0000-0x0000000003FFA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/2164-157-0x00000000033A0000-0x0000000003FFA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/6044-220-0x0000000003C80000-0x00000000048DA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/6044-223-0x0000000003C80000-0x00000000048DA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/6044-226-0x0000000003C80000-0x00000000048DA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/6044-224-0x0000000003C80000-0x00000000048DA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/6044-222-0x0000000003C80000-0x00000000048DA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/6044-221-0x0000000003C80000-0x00000000048DA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore - Enumerates VirtualBox DLL files 2 TTPs 12 IoCs
description ioc Process File opened (read-only) C:\Windows\SysWOW64\vboxhook.dll SppExtComObj.Exe File opened (read-only) C:\Windows\SysWOW64\vboxoglerrorspu.dll SppExtComObj.Exe File opened (read-only) C:\Windows\SysWOW64\vboxdisp.dll SppExtComObj.Exe File opened (read-only) C:\Windows\SysWOW64\vboxdisp.dll 2026-05-03_b14fbaaa4669e5a166f6ee46d5c85c02_akira_elex_glassworm.exe File opened (read-only) C:\Windows\SysWOW64\vboxoglerrorspu.dll 2026-05-03_b14fbaaa4669e5a166f6ee46d5c85c02_akira_elex_glassworm.exe File opened (read-only) C:\Windows\SysWOW64\vboxhook.dll SppExtComObj.Exe File opened (read-only) C:\Windows\SysWOW64\vboxoglerrorspu.dll SppExtComObj.Exe File opened (read-only) C:\Windows\SysWOW64\vboxhook.dll 2026-05-03_b14fbaaa4669e5a166f6ee46d5c85c02_akira_elex_glassworm.exe File opened (read-only) C:\Windows\SysWOW64\vboxdisp.dll SppExtComObj.Exe File opened (read-only) C:\Windows\SysWOW64\vboxhook.dll SppExtComObj.Exe File opened (read-only) C:\Windows\SysWOW64\vboxoglerrorspu.dll SppExtComObj.Exe File opened (read-only) C:\Windows\SysWOW64\vboxdisp.dll SppExtComObj.Exe - Enumerates VirtualBox registry keys 2 TTPs 8 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest 2026-05-03_b14fbaaa4669e5a166f6ee46d5c85c02_akira_elex_glassworm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse 2026-05-03_b14fbaaa4669e5a166f6ee46d5c85c02_akira_elex_glassworm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse SppExtComObj.Exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest SppExtComObj.Exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse SppExtComObj.Exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest SppExtComObj.Exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest SppExtComObj.Exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse SppExtComObj.Exe - Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ SppExtComObj.Exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ SppExtComObj.Exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ SppExtComObj.Exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 2026-05-03_b14fbaaa4669e5a166f6ee46d5c85c02_akira_elex_glassworm.exe - Looks for VirtualBox Guest Additions in registry 2 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions SppExtComObj.Exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions SppExtComObj.Exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions 2026-05-03_b14fbaaa4669e5a166f6ee46d5c85c02_akira_elex_glassworm.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions SppExtComObj.Exe - Looks for VirtualBox drivers on disk 2 TTPs 8 IoCs
description ioc Process File opened (read-only) C:\Windows\SysWOW64\drivers\VBoxMouse.sys SppExtComObj.Exe File opened (read-only) C:\Windows\SysWOW64\drivers\VBoxGuest.sys SppExtComObj.Exe File opened (read-only) C:\Windows\SysWOW64\drivers\VBoxMouse.sys SppExtComObj.Exe File opened (read-only) C:\Windows\SysWOW64\drivers\VBoxGuest.sys SppExtComObj.Exe File opened (read-only) C:\Windows\SysWOW64\drivers\VBoxMouse.sys SppExtComObj.Exe File opened (read-only) C:\Windows\SysWOW64\drivers\VBoxGuest.sys SppExtComObj.Exe File opened (read-only) C:\Windows\SysWOW64\drivers\VBoxMouse.sys 2026-05-03_b14fbaaa4669e5a166f6ee46d5c85c02_akira_elex_glassworm.exe File opened (read-only) C:\Windows\SysWOW64\drivers\VBoxGuest.sys 2026-05-03_b14fbaaa4669e5a166f6ee46d5c85c02_akira_elex_glassworm.exe - UPX dump on OEP (original entry point) 41 IoCs
resource yara_rule behavioral2/memory/5332-14-0x0000000003B80000-0x00000000047DA000-memory.dmp UPX behavioral2/memory/5332-30-0x0000000003B80000-0x00000000047DA000-memory.dmp UPX behavioral2/memory/5332-32-0x0000000003B80000-0x00000000047DA000-memory.dmp UPX behavioral2/memory/5332-35-0x0000000003B80000-0x00000000047DA000-memory.dmp UPX behavioral2/memory/5332-33-0x0000000003B80000-0x00000000047DA000-memory.dmp UPX behavioral2/memory/5332-31-0x0000000003B80000-0x00000000047DA000-memory.dmp UPX behavioral2/memory/5332-36-0x0000000003B80000-0x00000000047DA000-memory.dmp UPX behavioral2/memory/5332-38-0x0000000003B80000-0x00000000047DA000-memory.dmp UPX behavioral2/memory/5332-39-0x0000000003B80000-0x00000000047DA000-memory.dmp UPX behavioral2/memory/5332-41-0x0000000003B80000-0x00000000047DA000-memory.dmp UPX behavioral2/memory/5332-42-0x0000000003B80000-0x00000000047DA000-memory.dmp UPX behavioral2/memory/5332-50-0x0000000003B80000-0x00000000047DA000-memory.dmp UPX behavioral2/memory/3372-70-0x0000000003FE0000-0x0000000004C3A000-memory.dmp UPX behavioral2/memory/3372-84-0x0000000003FE0000-0x0000000004C3A000-memory.dmp UPX behavioral2/memory/3372-85-0x0000000003FE0000-0x0000000004C3A000-memory.dmp UPX behavioral2/memory/3372-88-0x0000000003FE0000-0x0000000004C3A000-memory.dmp UPX behavioral2/memory/3372-90-0x0000000003FE0000-0x0000000004C3A000-memory.dmp UPX behavioral2/memory/3372-89-0x0000000003FE0000-0x0000000004C3A000-memory.dmp UPX behavioral2/memory/3372-86-0x0000000003FE0000-0x0000000004C3A000-memory.dmp UPX behavioral2/memory/3372-87-0x0000000003FE0000-0x0000000004C3A000-memory.dmp UPX behavioral2/memory/3372-92-0x0000000003FE0000-0x0000000004C3A000-memory.dmp UPX behavioral2/memory/3372-93-0x0000000003FE0000-0x0000000004C3A000-memory.dmp UPX behavioral2/memory/3372-99-0x0000000003FE0000-0x0000000004C3A000-memory.dmp UPX behavioral2/memory/3372-100-0x0000000003FE0000-0x0000000004C3A000-memory.dmp UPX behavioral2/memory/3372-101-0x0000000003FE0000-0x0000000004C3A000-memory.dmp UPX behavioral2/memory/3372-103-0x0000000003FE0000-0x0000000004C3A000-memory.dmp UPX behavioral2/memory/2164-126-0x00000000033A0000-0x0000000003FFA000-memory.dmp UPX behavioral2/memory/2164-154-0x00000000033A0000-0x0000000003FFA000-memory.dmp UPX behavioral2/memory/2164-156-0x00000000033A0000-0x0000000003FFA000-memory.dmp UPX behavioral2/memory/2164-158-0x00000000033A0000-0x0000000003FFA000-memory.dmp UPX behavioral2/memory/2164-159-0x00000000033A0000-0x0000000003FFA000-memory.dmp UPX behavioral2/memory/2164-155-0x00000000033A0000-0x0000000003FFA000-memory.dmp UPX behavioral2/memory/2164-165-0x00000000033A0000-0x0000000003FFA000-memory.dmp UPX behavioral2/memory/2164-157-0x00000000033A0000-0x0000000003FFA000-memory.dmp UPX behavioral2/memory/6044-197-0x0000000003C80000-0x00000000048DA000-memory.dmp UPX behavioral2/memory/6044-220-0x0000000003C80000-0x00000000048DA000-memory.dmp UPX behavioral2/memory/6044-223-0x0000000003C80000-0x00000000048DA000-memory.dmp UPX behavioral2/memory/6044-226-0x0000000003C80000-0x00000000048DA000-memory.dmp UPX behavioral2/memory/6044-224-0x0000000003C80000-0x00000000048DA000-memory.dmp UPX behavioral2/memory/6044-222-0x0000000003C80000-0x00000000048DA000-memory.dmp UPX behavioral2/memory/6044-221-0x0000000003C80000-0x00000000048DA000-memory.dmp UPX - Looks for VMWare Tools registry key 2 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools 2026-05-03_b14fbaaa4669e5a166f6ee46d5c85c02_akira_elex_glassworm.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools SppExtComObj.Exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools SppExtComObj.Exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools SppExtComObj.Exe - Looks for VMWare drivers on disk 2 TTPs 8 IoCs
description ioc Process File opened (read-only) C:\Windows\SysWOW64\drivers\vmmouse.sys SppExtComObj.Exe File opened (read-only) C:\Windows\SysWOW64\drivers\vmhgfs.sys SppExtComObj.Exe File opened (read-only) C:\Windows\SysWOW64\drivers\vmmouse.sys SppExtComObj.Exe File opened (read-only) C:\Windows\SysWOW64\drivers\vmhgfs.sys SppExtComObj.Exe File opened (read-only) C:\Windows\SysWOW64\drivers\vmmouse.sys SppExtComObj.Exe File opened (read-only) C:\Windows\SysWOW64\drivers\vmhgfs.sys SppExtComObj.Exe File opened (read-only) C:\Windows\SysWOW64\drivers\vmmouse.sys 2026-05-03_b14fbaaa4669e5a166f6ee46d5c85c02_akira_elex_glassworm.exe File opened (read-only) C:\Windows\SysWOW64\drivers\vmhgfs.sys 2026-05-03_b14fbaaa4669e5a166f6ee46d5c85c02_akira_elex_glassworm.exe - Looks for VMWare services registry key. 1 TTPs 8 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse 2026-05-03_b14fbaaa4669e5a166f6ee46d5c85c02_akira_elex_glassworm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse SppExtComObj.Exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse SppExtComObj.Exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools SppExtComObj.Exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse SppExtComObj.Exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools 2026-05-03_b14fbaaa4669e5a166f6ee46d5c85c02_akira_elex_glassworm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools SppExtComObj.Exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools SppExtComObj.Exe - Executes dropped EXE 3 IoCs
pid Process 3372 SppExtComObj.Exe 2164 SppExtComObj.Exe 6044 SppExtComObj.Exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
resource yara_rule behavioral2/memory/5332-14-0x0000000003B80000-0x00000000047DA000-memory.dmp upx behavioral2/memory/5332-30-0x0000000003B80000-0x00000000047DA000-memory.dmp upx behavioral2/memory/5332-32-0x0000000003B80000-0x00000000047DA000-memory.dmp upx behavioral2/memory/5332-35-0x0000000003B80000-0x00000000047DA000-memory.dmp upx behavioral2/memory/5332-33-0x0000000003B80000-0x00000000047DA000-memory.dmp upx behavioral2/memory/5332-31-0x0000000003B80000-0x00000000047DA000-memory.dmp upx behavioral2/memory/5332-36-0x0000000003B80000-0x00000000047DA000-memory.dmp upx behavioral2/memory/5332-38-0x0000000003B80000-0x00000000047DA000-memory.dmp upx behavioral2/memory/5332-39-0x0000000003B80000-0x00000000047DA000-memory.dmp upx behavioral2/memory/5332-41-0x0000000003B80000-0x00000000047DA000-memory.dmp upx behavioral2/memory/5332-42-0x0000000003B80000-0x00000000047DA000-memory.dmp upx behavioral2/memory/5332-50-0x0000000003B80000-0x00000000047DA000-memory.dmp upx behavioral2/memory/3372-70-0x0000000003FE0000-0x0000000004C3A000-memory.dmp upx behavioral2/memory/3372-84-0x0000000003FE0000-0x0000000004C3A000-memory.dmp upx behavioral2/memory/3372-85-0x0000000003FE0000-0x0000000004C3A000-memory.dmp upx behavioral2/memory/3372-88-0x0000000003FE0000-0x0000000004C3A000-memory.dmp upx behavioral2/memory/3372-90-0x0000000003FE0000-0x0000000004C3A000-memory.dmp upx behavioral2/memory/3372-89-0x0000000003FE0000-0x0000000004C3A000-memory.dmp upx behavioral2/memory/3372-86-0x0000000003FE0000-0x0000000004C3A000-memory.dmp upx behavioral2/memory/3372-87-0x0000000003FE0000-0x0000000004C3A000-memory.dmp upx behavioral2/memory/3372-92-0x0000000003FE0000-0x0000000004C3A000-memory.dmp upx behavioral2/memory/3372-93-0x0000000003FE0000-0x0000000004C3A000-memory.dmp upx behavioral2/memory/3372-99-0x0000000003FE0000-0x0000000004C3A000-memory.dmp upx behavioral2/memory/3372-100-0x0000000003FE0000-0x0000000004C3A000-memory.dmp upx behavioral2/memory/3372-101-0x0000000003FE0000-0x0000000004C3A000-memory.dmp upx behavioral2/memory/3372-103-0x0000000003FE0000-0x0000000004C3A000-memory.dmp upx behavioral2/memory/2164-126-0x00000000033A0000-0x0000000003FFA000-memory.dmp upx behavioral2/memory/2164-154-0x00000000033A0000-0x0000000003FFA000-memory.dmp upx behavioral2/memory/2164-156-0x00000000033A0000-0x0000000003FFA000-memory.dmp upx behavioral2/memory/2164-158-0x00000000033A0000-0x0000000003FFA000-memory.dmp upx behavioral2/memory/2164-159-0x00000000033A0000-0x0000000003FFA000-memory.dmp upx behavioral2/memory/2164-155-0x00000000033A0000-0x0000000003FFA000-memory.dmp upx behavioral2/memory/2164-165-0x00000000033A0000-0x0000000003FFA000-memory.dmp upx behavioral2/memory/2164-157-0x00000000033A0000-0x0000000003FFA000-memory.dmp upx behavioral2/memory/6044-197-0x0000000003C80000-0x00000000048DA000-memory.dmp upx behavioral2/memory/6044-220-0x0000000003C80000-0x00000000048DA000-memory.dmp upx behavioral2/memory/6044-223-0x0000000003C80000-0x00000000048DA000-memory.dmp upx behavioral2/memory/6044-226-0x0000000003C80000-0x00000000048DA000-memory.dmp upx behavioral2/memory/6044-224-0x0000000003C80000-0x00000000048DA000-memory.dmp upx behavioral2/memory/6044-222-0x0000000003C80000-0x00000000048DA000-memory.dmp upx behavioral2/memory/6044-221-0x0000000003C80000-0x00000000048DA000-memory.dmp upx - Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Windows NT\b1991b9a-8304-730e-a635-a4250f039a83 2026-05-03_b14fbaaa4669e5a166f6ee46d5c85c02_akira_elex_glassworm.exe File opened for modification C:\Program Files (x86)\Windows NT\SppExtComObj.Exe 2026-05-03_b14fbaaa4669e5a166f6ee46d5c85c02_akira_elex_glassworm.exe File opened for modification C:\Program Files\Google\Chrome\Application\SppExtComObj.Exe SppExtComObj.Exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SppExtComObj.Exe SppExtComObj.Exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-03_b14fbaaa4669e5a166f6ee46d5c85c02_akira_elex_glassworm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SppExtComObj.Exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SppExtComObj.Exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SppExtComObj.Exe - Enumerates system info in registry 2 TTPs 20 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor 2026-05-03_b14fbaaa4669e5a166f6ee46d5c85c02_akira_elex_glassworm.exe Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\QEMU SppExtComObj.Exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer SppExtComObj.Exe Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\BIOS SppExtComObj.Exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer SppExtComObj.Exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName SppExtComObj.Exe Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\QEMU 2026-05-03_b14fbaaa4669e5a166f6ee46d5c85c02_akira_elex_glassworm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer 2026-05-03_b14fbaaa4669e5a166f6ee46d5c85c02_akira_elex_glassworm.exe Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\BIOS SppExtComObj.Exe Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\QEMU SppExtComObj.Exe Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\QEMU SppExtComObj.Exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName SppExtComObj.Exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor SppExtComObj.Exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor SppExtComObj.Exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer SppExtComObj.Exe Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\BIOS 2026-05-03_b14fbaaa4669e5a166f6ee46d5c85c02_akira_elex_glassworm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName 2026-05-03_b14fbaaa4669e5a166f6ee46d5c85c02_akira_elex_glassworm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName SppExtComObj.Exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor SppExtComObj.Exe Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\BIOS SppExtComObj.Exe - Suspicious behavior: EnumeratesProcesses 50 IoCs
pid Process 5332 2026-05-03_b14fbaaa4669e5a166f6ee46d5c85c02_akira_elex_glassworm.exe 5332 2026-05-03_b14fbaaa4669e5a166f6ee46d5c85c02_akira_elex_glassworm.exe 5332 2026-05-03_b14fbaaa4669e5a166f6ee46d5c85c02_akira_elex_glassworm.exe 5332 2026-05-03_b14fbaaa4669e5a166f6ee46d5c85c02_akira_elex_glassworm.exe 5332 2026-05-03_b14fbaaa4669e5a166f6ee46d5c85c02_akira_elex_glassworm.exe 5332 2026-05-03_b14fbaaa4669e5a166f6ee46d5c85c02_akira_elex_glassworm.exe 3372 SppExtComObj.Exe 3372 SppExtComObj.Exe 3372 SppExtComObj.Exe 3372 SppExtComObj.Exe 3372 SppExtComObj.Exe 3372 SppExtComObj.Exe 2164 SppExtComObj.Exe 2164 SppExtComObj.Exe 6060 powershell.exe 6060 powershell.exe 3372 SppExtComObj.Exe 3372 SppExtComObj.Exe 3372 SppExtComObj.Exe 3372 SppExtComObj.Exe 3372 SppExtComObj.Exe 3372 SppExtComObj.Exe 3372 SppExtComObj.Exe 3372 SppExtComObj.Exe 3372 SppExtComObj.Exe 3372 SppExtComObj.Exe 3372 SppExtComObj.Exe 3372 SppExtComObj.Exe 3372 SppExtComObj.Exe 3372 SppExtComObj.Exe 3372 SppExtComObj.Exe 3372 SppExtComObj.Exe 6044 SppExtComObj.Exe 6044 SppExtComObj.Exe 3372 SppExtComObj.Exe 3372 SppExtComObj.Exe 3372 SppExtComObj.Exe 3372 SppExtComObj.Exe 3372 SppExtComObj.Exe 3372 SppExtComObj.Exe 3372 SppExtComObj.Exe 3372 SppExtComObj.Exe 3372 SppExtComObj.Exe 3372 SppExtComObj.Exe 3372 SppExtComObj.Exe 3372 SppExtComObj.Exe 3372 SppExtComObj.Exe 3372 SppExtComObj.Exe 3372 SppExtComObj.Exe 3372 SppExtComObj.Exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 6060 powershell.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 5332 wrote to memory of 3372 5332 2026-05-03_b14fbaaa4669e5a166f6ee46d5c85c02_akira_elex_glassworm.exe 80 PID 3372 wrote to memory of 6060 3372 SppExtComObj.Exe 81 PID 3372 wrote to memory of 2164 3372 SppExtComObj.Exe 83 PID 3372 wrote to memory of 6044 3372 SppExtComObj.Exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-03_b14fbaaa4669e5a166f6ee46d5c85c02_akira_elex_glassworm.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-03_b14fbaaa4669e5a166f6ee46d5c85c02_akira_elex_glassworm.exe"1⤵
- Enumerates VirtualBox DLL files
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VirtualBox drivers on disk
- Looks for VMWare Tools registry key
- Looks for VMWare drivers on disk
- Looks for VMWare services registry key.
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5332 -
C:\Program Files (x86)\Windows NT\SppExtComObj.Exe"C:\Program Files (x86)\Windows NT\SppExtComObj.Exe"2⤵
- Enumerates VirtualBox DLL files
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VirtualBox drivers on disk
- Looks for VMWare Tools registry key
- Looks for VMWare drivers on disk
- Looks for VMWare services registry key.
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6060
-
-
C:\Program Files\Google\Chrome\Application\SppExtComObj.Exe"C:\Program Files\Google\Chrome\Application\SppExtComObj.Exe" -3⤵
- Enumerates VirtualBox DLL files
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VirtualBox drivers on disk
- Looks for VMWare Tools registry key
- Looks for VMWare drivers on disk
- Looks for VMWare services registry key.
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:2164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\SppExtComObj.Exe"C:\Program Files (x86)\Microsoft\Edge\Application\SppExtComObj.Exe" -3⤵
- Enumerates VirtualBox DLL files
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VirtualBox drivers on disk
- Looks for VMWare Tools registry key
- Looks for VMWare drivers on disk
- Looks for VMWare services registry key.
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:6044
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:3572
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:3416
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:1088
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Windows NT\SppExtComObj.Exe
- Size 19.3MB
- SHA256 27f242b2de539feea3bbb36e5b31356631335cdcb9f04e51e1260a6f916f3c38
- MD5 b14fbaaa4669e5a166f6ee46d5c85c02
- SHA1 9420cbbd9a0f63c903457cdd25e8e6cd5a62b8c4
- SHA512 1fcb97699d2541670c63b8561d7130a4a32fa18c74e9952bef7ee09c14894eedb7b3e0d97f83e29be0031e8dca8385ec8ffc5919a929a6931e9eec1384a7b755
- SSDEEP 393216:7p/YkzNzNzNzNzNzNzNzNzNzNzNzNzNzn:7p/JzNzNzNzNzNzNzNzNzNzNzNzNzNzn
- TLSH T1DD17120377FDB41AEA6B97B8D4642691C525FC778C61905A31CE04AB4F879043FBC2BA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\svc_356a49a7.log
- Size 2KB
- SHA256 607e176d424874ec41ec499583edcfc84075d6bee94fcb4b7f73d26a77197031
- MD5 58ec6446423c1ce7b4f86216c67abfde
- SHA1 a0c572563b2bd1838d84eadbe76cc1961fa9a10e
- SHA512 bf28967ebe4d36b93fb62df1a7ce9fe3badea721bd0e60da297857caeb10688bacd29379213ee41ee16f570dd367d86a618b30c5b72d75541ea2495268a602f9
- TLSH T151414E20313EBBB7DC8CF27894943A45245FB9AE640E1CB55636D14CAA4CC9EB8C8CF4
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\svc_356a49a7.log
- Size 2KB
- SHA256 d5bd6989fe09384e24abba1b3dc009ad1e6a85bddbafa22bb7720d4cf9e2302c
- MD5 f28b02a6d594761d48125e22818d28f3
- SHA1 146bb449583b334a474557ac86fb9efa866a005d
- SHA512 55b3a4fce648481c0d00ee3c48d784f4efca52d215c73ff6be133d776cb6a94d3ca978ad2bb62171a967a832e35df91ee2e0f238da20b9d5430d05895a2cde9a
- TLSH T199513C20313EBBB7DC8CF27894943A45245FB9AE644E1CB55636D14CAA4CC9EB8C8CF4
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\svc_356a49a7.log
- Size 2KB
- SHA256 54e00c4e9d738810d8cf5160a259f983a483b82c01a7d0245b66aacd9df559d0
- MD5 a1d84ee9504b173363ac7cbe1f1764b0
- SHA1 e021aada40fd2fc7f8f50f9bec91e608882a4188
- SHA512 3fc6a0b579e42efd2cfbc337bc55fffec5b79b23381407cdd496092f811d7b549e45c54345bcfb09a64a25eb32d00c7818f41fe09b47d2244c09113a54b3911c
- TLSH T128514A20313EBBB7DC8CF27894943A45245FB9AE644E1CB55636D14CAA4CC9EB8C8DF4
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\svc_356a49a7.log
- Size 3KB
- SHA256 8400c960462e0736f05e45b110a2e00c6cf43cfe6c0a12ca4eefb23051b346ce
- MD5 4d659bd2131d068c3428e6f748642594
- SHA1 61919cc066e98c7e36562159eeb089fa1b777636
- SHA512 05664e8174d708a395203b259769616c38439cf01195b2b1934b17afd8bfd674081a1fafee1d8b6e43fa4f70b227ea8c832a5df8b7008bc2f7ee831f392843ec
- TLSH T1E1713D20313EBBB7DC8CF27894943A45245FB9AE644E1CB55636D14CAA4CC9EB8C8CF4
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\svc_356a49a7.log
- Size 659B
- SHA256 eecf573ec562dd74acca6a1cebcba35ad5414731c9e8b8d41c6a250d1705cf47
- MD5 0357ccb0a55e58f16a73e783b01466e3
- SHA1 3411382876867c836f360999642e90b448abb63e
- SHA512 92d827aeb25d4999fa9e3b75708623f1e5cd8c99af3d6c8cf4f32e3c622eb046b9f93ff64879c2f3b006d292ce9d308819162633eff20b37f7f6adc69353d51b
- TLSH T1BA010220307EBBB7CC89F37894947B16255F796E741E1CB61536910C9A8CC9AB8C8CF4
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\svc_356a49a7.log
- Size 3KB
- SHA256 64a0d7e840bb7177a0645045902e18ab482f880b4914483d7590e4a469cbc6b6
- MD5 ecedc415af64dd215c60666edf6276af
- SHA1 f292fb3944e16b35f22dbeeeecb71ee0cf5106fc
- SHA512 fa63763b320b9db698a7f43e4a7111a78d60f3256bb758d445dadcfb8d8525cdeab5541fb8513a100daa809534b17616c8a1028662cd8135af04146ffbe3710c
- TLSH T138813A20313EBBB7DC8CF27894943A45245FB9AE644E1CB55636D14CAA4CC9EB8C8DF4
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\svc_356a49a7.log
- Size 968B
- SHA256 413114c4699a58d2862943bccbccb077d97d67123493e1d0d76a4a31fc5d59d0
- MD5 1a96970cbbfc2686e4a3159c6e1a199b
- SHA1 e2b80df27d5e10f7724596627c104685f848e9f4
- SHA512 41797975ef5aadf3fd88c34de32e8f1d4f2ac82a54b5a77ba3c3d53a858fb5a61803081d834954359a75efbe80b380c226bc9e67a4b98da14ad0b9dfd88760aa
- TLSH T1D8113920313EBBB7DC8CF27894943A45245FB9AE644E1CB55636D14CAA4CC9EA8C8DF4
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\svc_356a49a7.log
- Size 999B
- SHA256 5bf32a2beace3ce66cd6ebb377f7ff1c1250acb0d0f259502954ab96c1e9384d
- MD5 b0840bc848ed46bb152137e87d57c7bb
- SHA1 3d4bb92c7c57c2d3ea3beca7dba02b8fc7f9a41b
- SHA512 1a0169b110258028f4a6f6a06ae181b2ac3f59e53c4e3ce027a4e3c82d67e3cb85a1c82b9725a36a1a839dc28786f0838adb865c9725b0954b55974ae35caf1d
- TLSH T1D9115B20313EBBB7DC8CF27894943A45245FB9AE644E1CB55636D14CAA4CC9EA4C8CF0
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\svc_356a49a7.log
- Size 1KB
- SHA256 b8a778564e0397091496db2884d543f4b61a8d14bab959bbbd1b58b865dc8cb0
- MD5 17a67f545e92562d29d9fe128e671c47
- SHA1 78bed9a39c0c722e2c0416681c7aac5911cac7b2
- SHA512 3f59b1f1994d5181c67623ce62660c924c0da7162d22115abec4c2dbff39cd15b7407dc6858eec2005e39c2eaef2289784aca97225543fa5f8e164c690b50539
- TLSH T14E313D20313EBBB7CC8CF27894943A45245FB9AE645E1CB55536D14C9A4CC9EB8C8CF4
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\svc_356a49a7.log
- Size 390B
- SHA256 4678306bb51236b5fc753562832cc37f1f9233cb391b9468ab973099b5ff4259
- MD5 3589c4ecd54c71e10ea73d56739021fd
- SHA1 27287701bed1d5ce607480fc8e736076e5d94c03
- SHA512 9226cd4b53c94ff54f0466526804aefbff718a7a3dc20b742d26c8f489767d18d3394dbd491c395dbef650b250125eca39a13c38a56dc633c7c135eabe8102d8
- TLSH T19CE05220306EBBB78C89E37894947B15205FB92F780F1CA11532910C9A4C86AB488CF4
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\svc_356a49a7.log
- Size 1KB
- SHA256 68635bed6c9873fe62364859f9e1966f134a7c214a8f164502b35c72595a08d2
- MD5 072439ca86aec0d19d3c3656e41bdf4e
- SHA1 7d220a0933e97b41333a812a0bc2b8a09111cac9
- SHA512 bd087b2cf0ebb213369c6559a692edec4089d87f9d964a7c4ae13bb9654c39a4a3ff660768cadd9297d83b34de2b0ec253cd3fc79407aaef2c4f0685eb6c3af0
- TLSH T10D414A20313EBBB7DC8CF27894943A45245FB9AE644E1CB55636D14CAA4CC9EB8C8DF4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hzwp1r35.pb1.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH