Analysis
- max time kernel
150s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
12/07/2026, 16:21
General
- Target 2026-07-12_ad61ddf90656b7d27a4b283b31513a57_akira_amadey_elex_glassworm.exe
- Size 100.0MB
- Sample260712-tts2aac14j
- SHA256 ed6dcd07578338a1443cd4947bf1d2a6774364a6e39ff0d9b0fa41078c266729
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 8 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-12_ad61ddf90656b7d27a4b283b31513a57_akira_amadey_elex_glassworm.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-12_ad61ddf90656b7d27a4b283b31513a57_akira_amadey_elex_glassworm.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\714d7dbaee12fa18.jpg"2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\714d7dbaee12fa18.jpg"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵
- Checks SCSI registry key(s)
-
C:\ProgramData\Accounts\ae26a8eb\wabimpm.exeC:\ProgramData\Accounts\ae26a8eb\wabimpm.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
714d7dbaee12fa18.jpg
memory/624-5-0x0000000006280000-0x00000000062EE000-memory.dmp
memory/624-6-0x0000000006320000-0x000000000633A000-memory.dmp
memory/624-7-0x0000000006360000-0x000000000638C000-memory.dmp
memory/624-15-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-13-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-47-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-53-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-77-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-113-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-121-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-119-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-117-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-115-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-111-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-109-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-107-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-105-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-125-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-133-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-131-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-129-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-127-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-123-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-103-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-101-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-99-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-97-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-95-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-93-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-91-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-89-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-87-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-85-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-83-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-81-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-79-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-75-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-73-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-71-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-69-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-67-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-65-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-63-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-61-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-59-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-57-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-55-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-51-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-49-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-45-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-43-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-41-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-39-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-37-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-35-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-33-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-31-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-29-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-27-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-25-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-23-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-21-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-19-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-9-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-18-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-8-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-11-0x0000000006360000-0x0000000006386000-memory.dmp
memory/624-634-0x0000000006760000-0x00000000067C6000-memory.dmp
memory/624-635-0x00000000071D0000-0x0000000007262000-memory.dmp
memory/624-636-0x0000000007830000-0x0000000007DEA000-memory.dmp