b9533e515ed293192385daac25d79e43b02614d6beb55fccc2ec4f6ca0cbcaa3

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/06/2026, 00:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-25_115d07e35167acf8ea81f70a0b04c6cc_akira_glassworm_rusty-stealer.exe
Size 2.4MB
Sample260630-ac7cssbt5p
SHA256 b9533e515ed293192385daac25d79e43b02614d6beb55fccc2ec4f6ca0cbcaa3
MD5 115d07e35167acf8ea81f70a0b04c6cc
SHA1 81d254e13b2730a60db73e57a68d5c230714c1af
SHA512 0f076312b9476261960ef4d596c06e7197c842841e8cc019575bb7fc098fcd2cc264c6af97fdd5c742c239cf7849915c3c96a2612a04cd73a9c59fa0b8b191c2
SSDEEP 49152:DLdnZPcSsoo9NWl5i9CNUVXlJJr7sAf09kfcfOWDAOsM/ci7dcYIU6itO:DLdnZNulJJruizn+t
TLSH
T102B56C02BA4A55ECD199C8B4C34B8A739B7534CB0B35B9FF11D546253FAAAB41F2C309
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\stmgr.vbs	2026-06-25_115d07e35167acf8ea81f70a0b04c6cc_akira_glassworm_rusty-stealer.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
6140	tasklist.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	6140	tasklist.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5852 wrote to memory of 6140	5852	2026-06-25_115d07e35167acf8ea81f70a0b04c6cc_akira_glassworm_rusty-stealer.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-06-25_115d07e35167acf8ea81f70a0b04c6cc_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-25_115d07e35167acf8ea81f70a0b04c6cc_akira_glassworm_rusty-stealer.exe"
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:5852
- C:\Windows\system32\tasklist.exe
  "tasklist" /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:6140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads