598ed7f974ee58c0dc2331b558be6f31a369692e8c07c6224ad067dd5b9b79cc

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/05/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-05_f8616b1af54489f49b715166dad2cc7a_akira_frostygoop_glassworm_hive_knight_luca-stealer_rust.exe
Size 5.4MB
Sample260505-pergpafs8t
SHA256 598ed7f974ee58c0dc2331b558be6f31a369692e8c07c6224ad067dd5b9b79cc
MD5 f8616b1af54489f49b715166dad2cc7a
SHA1 caed141644521c52be019c9aed6c2bc5ffd1201b
SHA512 acdead9724d814a576fcb3e1e390615c31f86263d7d67515eb7e6838368538dc494b1d609c2849b80d347f452fb4fc12e9fa5afa8c2dacb4001494a2557de44b
SSDEEP 49152:swaZNRz4UXmsTSuR+Z1Vz78UAkzK5JcbARyoiDhaGn0ei0w9+s9Ww4y8YSi+rUp+:swmBMW8K5JC0bD9f9Ww4yLze+R9A
TLSH
T1C1465C07FA9145EDC869C1F486976A32BA72FD490B2167E72B90B7303E71BF45A38704
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

execution persistence

Malware Config

Signatures

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4764	schtasks.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3424 wrote to memory of 4764	3424	2026-05-05_f8616b1af54489f49b715166dad2cc7a_akira_frostygoop_glassworm_hive_knight_luca-stealer_rust.exe	79

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-05-05_f8616b1af54489f49b715166dad2cc7a_akira_frostygoop_glassworm_hive_knight_luca-stealer_rust.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-05_f8616b1af54489f49b715166dad2cc7a_akira_frostygoop_glassworm_hive_knight_luca-stealer_rust.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "MicrosoftWebViewUpdate" /TR "rundll32.exe C:\\ProgramData\\WebViewUpdate\\webview.dll,main" /SC ONLOGON /RL HIGHEST /DELAY 0000:59 /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4764

C:\Windows\system32\rundll32.exe
rundll32.exe
1⤵
PID:5536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads