a7e75d8e382baa62e0cc214d221b01c5398b4616b26d752dcb5f47678868d670

General

Target
2026-06-05_01fe10b4db24a4f44322c8a8fac2913a_glassworm_megazord_njrat.exe
Size 64.9MB
Sample260605-py79jsgz4j
SHA256 a7e75d8e382baa62e0cc214d221b01c5398b4616b26d752dcb5f47678868d670
MD5 01fe10b4db24a4f44322c8a8fac2913a
SHA1 ad8277bd2c0716be7d7a33a8f9ec5ada062be5b9
SHA512 a522e1b7622267f1ae8eaaceb25d0fcff9d307d034353f259a0845221e3bf885435cefc7db13772bb1ab25b6bfbb365fe4ababbdcb4231b4e50e103897ef7cfa
SSDEEP 393216:rdrz7whrhI2wjekYGDiOtyx9z2lZAYVFexglb/vE5L5OtsFtrNTaDvd44dJNgfuS:hgVJMiOAx9EeCUV5OtsFRta9dE
TLSH
T1F7E7AF15B3D80A06E63FC27DC2638112E7F1B4931352D6CF0558EA992F53BC1AB7B266
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ED_Updater.exe	2026-06-05_01fe10b4db24a4f44322c8a8fac2913a_glassworm_megazord_njrat.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ED_Updater.exe	2026-06-05_01fe10b4db24a4f44322c8a8fac2913a_glassworm_megazord_njrat.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ED_Updater.exe	ED_Updater.exe

Executes dropped EXE 1 IoCs

pid	Process
5468	ED_Updater.exe

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Windows\CurrentVersion\Run\ED_Heartbeat = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ED_Updater.exe"	2026-06-05_01fe10b4db24a4f44322c8a8fac2913a_glassworm_megazord_njrat.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4924	sc.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

File Deletion

Inhibit System Recovery

Direct Volume Access

pid	Process
2076	vssadmin.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
3632	schtasks.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4204 wrote to memory of 3632	4204	2026-06-05_01fe10b4db24a4f44322c8a8fac2913a_glassworm_megazord_njrat.exe	82
PID 4204 wrote to memory of 4924	4204	2026-06-05_01fe10b4db24a4f44322c8a8fac2913a_glassworm_megazord_njrat.exe	83
PID 4204 wrote to memory of 2076	4204	2026-06-05_01fe10b4db24a4f44322c8a8fac2913a_glassworm_megazord_njrat.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-05_01fe10b4db24a4f44322c8a8fac2913a_glassworm_megazord_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-05_01fe10b4db24a4f44322c8a8fac2913a_glassworm_megazord_njrat.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "ED_Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ED_Updater.exe" /sc onlogon /ru SYSTEM /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3632
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" create "ED_Heartbeat" binPath="C:\Users\Admin\AppData\Roaming\Eternal_Death\ED_Svc.exe" start=auto
  2⤵
  - Launches sc.exe
  PID:4924
- C:\Windows\SYSTEM32\vssadmin.exe
  "vssadmin" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:2076

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5248