7345401e4b16b1981e68e1a899e376d159be35b7f8afe549ffd06a148b5c7e65

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/07/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-03_03777c1c8235b75136f1d34742c658fb_akira_amadey_elex_glassworm.exe
Size 34.8MB
Sample260703-e5s34agt2k
SHA256 7345401e4b16b1981e68e1a899e376d159be35b7f8afe549ffd06a148b5c7e65
MD5 03777c1c8235b75136f1d34742c658fb
SHA1 235ccfdbba3954f3a1df7f66006de80c3c2dcb50
SHA512 345ab34034e414d9bcdd8b89342eeac5a0854b6e3d8864e5bbe4a04428da1da5dfdfa72146120c373ef7ab1d66935567dc1ba0d3a5a9c6e13950e157cf459239
SSDEEP 49152:GD+D8pl4zyaq5P1OWoIm6G+a9VZh/VgxFWYUtTe4s3QM1p:GD+D80e4Bh/VDtTjsAM1p
TLSH
T1D7876D1ABED578725BFED3935BD3CCBD8517900012633C9F298A17C88409BA8AF7625D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4740 created 3248	4740	AggregatorHost.exe	56

Detect binaries embedding considerable number of MFA browser extension IDs. 1 IoCs

resource	yara_rule
behavioral1/memory/4740-23-0x0000000008070000-0x0000000008088000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
behavioral1/memory/4740-23-0x0000000008070000-0x0000000008088000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral1/memory/4740-23-0x0000000008070000-0x0000000008088000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing bas64 encoded gzip files 1 IoCs

resource	yara_rule
behavioral1/memory/4740-23-0x0000000008070000-0x0000000008088000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	2026-07-03_03777c1c8235b75136f1d34742c658fb_akira_amadey_elex_glassworm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
4740	AggregatorHost.exe
4568	AggregatorHost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-03_03777c1c8235b75136f1d34742c658fb_akira_amadey_elex_glassworm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AggregatorHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AggregatorHost.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2668	POWERPNT.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4740	AggregatorHost.exe
4740	AggregatorHost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2668	POWERPNT.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4740	AggregatorHost.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2668	POWERPNT.EXE
2668	POWERPNT.EXE
2668	POWERPNT.EXE
2668	POWERPNT.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3896 wrote to memory of 1900	3896	2026-07-03_03777c1c8235b75136f1d34742c658fb_akira_amadey_elex_glassworm.exe	84
PID 1900 wrote to memory of 2668	1900	cmd.exe	86
PID 4740 wrote to memory of 4568	4740	AggregatorHost.exe	90

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3248
- C:\Users\Admin\AppData\Local\Temp\2026-07-03_03777c1c8235b75136f1d34742c658fb_akira_amadey_elex_glassworm.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-03_03777c1c8235b75136f1d34742c658fb_akira_amadey_elex_glassworm.exe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3896
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\bb96df80c634a61d.pptx"
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1900
  - - C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\bb96df80c634a61d.pptx" /ou ""
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      PID:2668
- C:\ProgramData\Microsoft\6491d1f7\AggregatorHost.exe
  C:\ProgramData\Microsoft\6491d1f7\AggregatorHost.exe --monitor 4740
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4568

C:\ProgramData\Microsoft\6491d1f7\AggregatorHost.exe
C:\ProgramData\Microsoft\6491d1f7\AggregatorHost.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
Size 471B
SHA256 e4b952f6b978733571c1f31f4e107c58c403783a2ad5fcc7f2787b4f9a075601
MD5 787511c45e42b7423772a7bba19f1e9c
SHA1 c3f03ac98b12b2f7fbf8f87960d27a415c1e7446
SHA512 d631d4bf14898b0eec1562adf946251318ff5bc16d551a05caae1d2e82dcaffe91e0223e04da04d7a7388d35f04eb2ed1f1ed612fa58260a6875236fd52124a8
TLSH
T167F0DCE220D8F4116D9F89EC3DA0437A3820566D07EA2A24A0BC94B145966AA621E23A
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
Size 412B
SHA256 82f170ab9bcfd03359c7473db0ce4662e6ffd5193fc36de2edcf0866e1a2971e
MD5 57cd8da0187db3b74ec7447d6931f634
SHA1 6ae8de9497b62dbc80d8f49a3b6086a97ff6a52e
SHA512 5bbe2073495c157f5903572b0a4ddacfdd6c027c16d20411db0fafa69516977603c5813c49f38f21478f073367876fee5eb80ec9206b9cdd9dc38c560a8f254a
TLSH
T192E0C62029FB021EF1F1D1384FDA783084AAF1262800E3BA1BE06718A60AB04FC62D30
MD5 SHA1 SHA512 TLSH

Submit Download

Tmp774E.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp774E.tmp
Size 2KB
SHA256 cce1d05d1856c66d95f205e985fae9d50d5bca786c6c6ee5c81f78c38aff1f57
MD5 c974d55345218c25d00d118b73d79fec
SHA1 2e697c1023a01396084a78133740573956aa5e8b
SHA512 1008fb505d08bf6f60f056555d9db8ba7748c6133032ee96ba94370f56e7e0c66645cda175cda55f116febc3fd7bae81c70c3ae41f8d5759446c42cbe1a4b8db
TLSH
T16141286B1DE1DAC138AE584CC0AE66231520F16358B06D6F6124B1E611939297F0CAF3
MD5 SHA1 SHA512 TLSH

Submit Download

bb96df80c634a61d.pptx

Path C:\Users\Admin\AppData\Local\Temp\bb96df80c634a61d.pptx
Size 15.5MB
SHA256 0b32e4480e08f487e2264a1bb5444ca31807c43f8e77f3df2fb7efa39a5f6a6d
MD5 b55f5d476bcd416dc720326b84e24d4c
SHA1 11303d06dac09134e0ff1db6eb113b4c6dc7202c
SHA512 f27ad9e65083b3a3546cc630678e9d3cfc7a279e17578628d3b721c82de870f8620a17e23d432d6864d9b73155475e7a16fbc849bdb1e9f7da379a50c3c92ce0
SSDEEP 393216:kI9ujzoA3fQdg8YZfmOrm4u4uJoIuGv/uzieRmRc3iYsO8aoovT:kIGN3YdgVlTanXsieRJgO8M
TLSH
T187F63306AD804A01C02A797ADCFE8591D3EB9DE1AC61600F3B8DDD08DF449BEDCDA597
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2668-13-0x00007FFCBF350000-0x00007FFCBF360000-memory.dmp

Download

memory/2668-10-0x00007FFCC13B0000-0x00007FFCC13C0000-memory.dmp

Download

memory/2668-8-0x00007FFCC13B0000-0x00007FFCC13C0000-memory.dmp

Download

memory/2668-14-0x00007FFCBF350000-0x00007FFCBF360000-memory.dmp

Download

memory/2668-5-0x00007FFCC13B0000-0x00007FFCC13C0000-memory.dmp

Download

memory/2668-6-0x00007FFCC13B0000-0x00007FFCC13C0000-memory.dmp

Download

memory/2668-7-0x00007FFCC13B0000-0x00007FFCC13C0000-memory.dmp

Download

memory/4740-22-0x0000000008000000-0x0000000008054000-memory.dmp

Download

memory/4740-23-0x0000000008070000-0x0000000008088000-memory.dmp

Download

memory/4740-24-0x0000000008110000-0x000000000815C000-memory.dmp

Download

memory/4740-41-0x0000000008350000-0x00000000083B6000-memory.dmp

Download