Analysis
- max time kernel
150s - max time network
158s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
04/07/2026, 10:40
General
- Target 2026-07-04_2e499de6c09af1c61943805f77e68b2a_akira_amadey_elex_glassworm.exe
- Size 100.0MB
- Sample260704-mqmlrset8w
- SHA256 185f587f92831ec5a69addb0a7b8d49fa3c34e32027830554b982d096c44a5ec
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Detect binaries embedding considerable number of MFA browser extension IDs. 1 IoCs
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
- Detects executables containing bas64 encoded gzip files 1 IoCs
- Executes dropped EXE 2 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-07-04_2e499de6c09af1c61943805f77e68b2a_akira_amadey_elex_glassworm.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-04_2e499de6c09af1c61943805f77e68b2a_akira_amadey_elex_glassworm.exe"2⤵
-
-
C:\ProgramData\Windows Defender\21e55f80\ZillberRelayHost.exe"C:\ProgramData\Windows Defender\21e55f80\ZillberRelayHost.exe" --monitor 15162⤵
- Executes dropped EXE
-
-
C:\ProgramData\Windows Defender\21e55f80\ZillberRelayHost.exe"C:\ProgramData\Windows Defender\21e55f80\ZillberRelayHost.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
TmpDF01.tmp
memory/1516-7-0x0000000073A72000-0x0000000073A73000-memory.dmp
memory/1516-8-0x00000000066C0000-0x0000000006714000-memory.dmp
memory/1516-9-0x0000000073A60000-0x000000007421C000-memory.dmp
memory/1516-10-0x00000000018F0000-0x0000000001908000-memory.dmp
memory/1516-11-0x0000000006780000-0x00000000067CC000-memory.dmp
memory/1516-12-0x0000000073A60000-0x000000007421C000-memory.dmp
memory/1516-23-0x0000000073A60000-0x000000007421C000-memory.dmp
memory/1516-24-0x0000000073A60000-0x000000007421C000-memory.dmp
memory/1516-25-0x00000000068A0000-0x0000000006906000-memory.dmp
memory/1516-26-0x0000000006ED0000-0x0000000006F62000-memory.dmp
memory/1516-27-0x0000000007530000-0x0000000007AEA000-memory.dmp
memory/1516-28-0x0000000073A72000-0x0000000073A73000-memory.dmp
memory/1516-29-0x0000000073A60000-0x000000007421C000-memory.dmp
memory/1516-30-0x0000000073A60000-0x000000007421C000-memory.dmp
memory/1516-31-0x0000000007BF0000-0x0000000007CC2000-memory.dmp
memory/1516-35-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-37-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-33-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-32-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-49-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-47-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-46-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-44-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-62-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-63-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-67-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-70-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-65-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-59-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-58-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-56-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-54-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-51-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-39-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-41-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-71-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-82-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-80-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-85-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-101-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-110-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-128-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-145-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-155-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-158-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-153-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-152-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-150-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-148-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-143-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-141-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-139-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-137-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-135-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-133-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-131-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-129-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-126-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-124-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-121-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-119-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-118-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-116-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-114-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-111-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-108-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-106-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-103-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-100-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-97-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-95-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-93-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-92-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-89-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-87-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-83-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-77-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-76-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-74-0x0000000007BF0000-0x0000000007CBD000-memory.dmp
memory/1516-3134-0x0000000007520000-0x000000000752A000-memory.dmp