Overview

overview

7

Static

static

3

2026-06-26...rm.exe

windows10-2004-x64

7

2026-06-26...rm.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    140s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/06/2026, 13:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-26_a3827af1f8d35f4090508a56e0e10a83_akira_amadey_blankgrabber_elex_glassworm.exe
  • Size 31.0MB
  • Sample260629-qrfrdsgs4r
  • SHA256 86b30cd368f4ea342257f385cf21e8fd3f1bc4370341fd6621ea946b13edfeaf
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoverypersistence

Malware Config

Signatures

  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 9 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 49 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies data under HKEY_USERS 7 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-26_a3827af1f8d35f4090508a56e0e10a83_akira_amadey_blankgrabber_elex_glassworm.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-26_a3827af1f8d35f4090508a56e0e10a83_akira_amadey_blankgrabber_elex_glassworm.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:6124
    • C:\Users\Admin\Downloads\inst-dotnet-9.0.0-X64-WindowsDesktop.exe
      "C:\Users\Admin\Downloads\inst-dotnet-9.0.0-X64-WindowsDesktop.exe" /norestart /passive /showrmui
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5964
      • C:\Windows\Temp\{1C5F08B9-9C31-4353-B0C4-37B70D76C72C}\.cr\inst-dotnet-9.0.0-X64-WindowsDesktop.exe
        "C:\Windows\Temp\{1C5F08B9-9C31-4353-B0C4-37B70D76C72C}\.cr\inst-dotnet-9.0.0-X64-WindowsDesktop.exe" -burn.clean.room="C:\Users\Admin\Downloads\inst-dotnet-9.0.0-X64-WindowsDesktop.exe" -burn.filehandle.attached=748 -burn.filehandle.self=752 /norestart /passive /showrmui
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:6032
        • C:\Windows\Temp\{B2ABE5AF-3BD3-479A-B114-A68E67D25A8E}\.be\windowsdesktop-runtime-9.0.17-win-x64.exe
          "C:\Windows\Temp\{B2ABE5AF-3BD3-479A-B114-A68E67D25A8E}\.be\windowsdesktop-runtime-9.0.17-win-x64.exe" -q -burn.elevated BurnPipe.{362BB889-5D6C-42E3-9602-9986FC32E1D3} {81B6EA01-0EAB-4FB4-B8B2-E75D576AC1E2} 6032
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          PID:4336
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 6032 -s 876
          4⤵
          • Program crash
          PID:1040
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5320
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding A57F966B7A45A29B1900D1601B09DFA5
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:6208
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 4D7B69D76C0AF5EBA1CF4AB2AF994108
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1340
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding D711DECB698E4779D263D87D89763D20
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2592
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding B820F1E315322C2FD9CE9C1BA72247B9
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:5480
  • C:\ProgramData\Package Cache\{df745324-5cb5-434e-80ec-1238a7c258a3}\windowsdesktop-runtime-9.0.17-win-x64.exe
    "C:\ProgramData\Package Cache\{df745324-5cb5-434e-80ec-1238a7c258a3}\windowsdesktop-runtime-9.0.17-win-x64.exe" /burn.runonce
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:7076
    • C:\ProgramData\Package Cache\{df745324-5cb5-434e-80ec-1238a7c258a3}\windowsdesktop-runtime-9.0.17-win-x64.exe
      "C:\ProgramData\Package Cache\{df745324-5cb5-434e-80ec-1238a7c258a3}\windowsdesktop-runtime-9.0.17-win-x64.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.17_(x64)_20260629142951.log" /showrmui
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:6472
      • C:\ProgramData\Package Cache\{df745324-5cb5-434e-80ec-1238a7c258a3}\windowsdesktop-runtime-9.0.17-win-x64.exe
        "C:\ProgramData\Package Cache\{df745324-5cb5-434e-80ec-1238a7c258a3}\windowsdesktop-runtime-9.0.17-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{df745324-5cb5-434e-80ec-1238a7c258a3}\windowsdesktop-runtime-9.0.17-win-x64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.17_(x64)_20260629142951.log" /showrmui
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:3616
        • C:\ProgramData\Package Cache\{df745324-5cb5-434e-80ec-1238a7c258a3}\windowsdesktop-runtime-9.0.17-win-x64.exe
          "C:\ProgramData\Package Cache\{df745324-5cb5-434e-80ec-1238a7c258a3}\windowsdesktop-runtime-9.0.17-win-x64.exe" -q -burn.elevated BurnPipe.{945DB50E-FEAB-49E7-B8D8-06C5B5933F1C} {C0A64CB7-F1EA-49E9-874C-44DC0191F9BD} 3616
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:2504
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3616 -s 1028
          4⤵
          • Program crash
          PID:5700
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 6032 -ip 6032
    1⤵
      PID:1484
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3616 -ip 3616
      1⤵
        PID:6700

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            e58de19.rbs
            • Path C:\Config.Msi\e58de19.rbs
            • Size 48KB
            • SHA256 0d7b97e287ef14ca4eb2a8352514130d54e06d7223db1f6306965069b31ffe04
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e58de1e.rbs
            • Path C:\Config.Msi\e58de1e.rbs
            • Size 9KB
            • SHA256 7a9485cc140f845ccfb86858b1b878f5e9ef3262b8bafe4b2394ab3e35e3d04c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e58de23.rbs
            • Path C:\Config.Msi\e58de23.rbs
            • Size 10KB
            • SHA256 f70f53f3ba77eb6de5dd81acaad8211428756e818f79b8bdc5b79e928c2a84ad
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ThirdPartyNotices.txt
            • Path C:\Program Files\dotnet\ThirdPartyNotices.txt
            • Size 77KB
            • SHA256 e8ddd95ac905467e4e519b446ca023fa00c31732bebd9b66e65101c712092ee7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            state.rsm
            • Path C:\ProgramData\Package Cache\{df745324-5cb5-434e-80ec-1238a7c258a3}\state.rsm
            • Size 930B
            • SHA256 1fd5724fee9d80075614b097adb33632018242fc99afd6bc8d9194e216bab89d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Microsoft_Windows_Desktop_Runtime_-_9.0.17_(x64)_20260629142951.log
            • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.17_(x64)_20260629142951.log
            • Size 10KB
            • SHA256 5affd8d0885aaad79b3ed4de9f2f33324c7ff0c0267e692d6091bb4f8bf906db
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft_Windows_Desktop_Runtime_-_9.0.17_(x64)_20260629142951_000_dotnet_runtime_9.0.17_win_x64.msi.log
            • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.17_(x64)_20260629142951_000_dotnet_runtime_9.0.17_win_x64.msi.log
            • Size 3KB
            • SHA256 666a11a0dd20f85d35ad8fe130c381b4501db84fd8eaa429118ebf2f8ba37b10
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            MSIEA6B.tmp
            • Path C:\Windows\Installer\MSIEA6B.tmp
            • Size 219KB
            • SHA256 2bf33a9b9980e44d21d48f04cc6ac4eed4c68f207bd5990b7d3254a310b944ae
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            inst-dotnet-9.0.0-X64-WindowsDesktop.exe
            • Path C:\Windows\Temp\{1C5F08B9-9C31-4353-B0C4-37B70D76C72C}\.cr\inst-dotnet-9.0.0-X64-WindowsDesktop.exe
            • Size 607KB
            • SHA256 b0130d17ffd269d510eddb7026d2d8198f5b6e2c92b5c5f314daee1cd4882d9c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            thm.wxl
            • Path C:\Windows\Temp\{8053FC43-0756-4F5F-BCBE-9DEE2E375B9D}\.ba\1033\thm.wxl
            • Size 5KB
            • SHA256 81a68046b06e09385be8449373e7ceb9e79f7724c3cf11f0b18a4489a8d4926a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            bg.png
            • Path C:\Windows\Temp\{B2ABE5AF-3BD3-479A-B114-A68E67D25A8E}\.ba\bg.png
            • Size 4KB
            • SHA256 9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wixstdba.dll
            • Path C:\Windows\Temp\{B2ABE5AF-3BD3-479A-B114-A68E67D25A8E}\.ba\wixstdba.dll
            • Size 190KB
            • SHA256 dcea15f3710822ffc262e62ec04cc7bbbf0f33f5d1a853609fbfb65cb6a45640
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dotnet_host_9.0.17_win_x64.msi
            • Path C:\Windows\Temp\{B2ABE5AF-3BD3-479A-B114-A68E67D25A8E}\dotnet_host_9.0.17_win_x64.msi
            • Size 704KB
            • SHA256 753a72d4f2b9b3cce438ee152d519fa972011377c6ab94d5cafa502529234fbf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dotnet_hostfxr_9.0.17_win_x64.msi
            • Path C:\Windows\Temp\{B2ABE5AF-3BD3-479A-B114-A68E67D25A8E}\dotnet_hostfxr_9.0.17_win_x64.msi
            • Size 776KB
            • SHA256 fbb88be7b6a0d460c90624fda80eb12a68c7c042a727f0118e3aec3aa52283d9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dotnet_runtime_9.0.17_win_x64.msi
            • Path C:\Windows\Temp\{B2ABE5AF-3BD3-479A-B114-A68E67D25A8E}\dotnet_runtime_9.0.17_win_x64.msi
            • Size 27.5MB
            • SHA256 d87c6a255667b9e92018c80cb3952ae9350a0374560fd49b4f02079e91266383
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            windowsdesktop_runtime_9.0.17_win_x64.msi
            • Path C:\Windows\Temp\{B2ABE5AF-3BD3-479A-B114-A68E67D25A8E}\windowsdesktop_runtime_9.0.17_win_x64.msi
            • Size 29.9MB
            • SHA256 06421abd85426b1b9f068608ed89565559dd2734ae638a35ce9a541f8e12902a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download