Analysis
- max time kernel
150s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
14/07/2026, 11:04
General
- Target 2026-07-14_d25fc34bb7b966b9862bb2a407ae6067_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe
- Size 93.3MB
- Sample260714-m6eabsbs4j
- SHA256 26e681b0d0d774f2424de2c4864486165a1275555fd28c02e1ba088c8b4ee5ed
Malware Config
Signatures
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Maps connected drives based on registry 3 TTPs 3 IoCs
Disk information is often read in order to detect sandboxing environments.
- Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 24 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-14_d25fc34bb7b966b9862bb2a407ae6067_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-14_d25fc34bb7b966b9862bb2a407ae6067_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe"1⤵
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1464-0-0x000001D17F412000-0x000001D17F413000-memory.dmp
memory/1464-1-0x000001D17F410000-0x000001D17F411000-memory.dmp
memory/1464-2-0x000001D17F413000-0x000001D17F414000-memory.dmp
memory/1464-3-0x000001D17F414000-0x000001D17F415000-memory.dmp
memory/1464-9-0x000001D17F415000-0x000001D17F416000-memory.dmp
memory/1464-11-0x000001D17F416000-0x000001D17F418000-memory.dmp
memory/1464-10-0x000001D17F418000-0x000001D17F419000-memory.dmp
memory/1464-23-0x000001D17F41B000-0x000001D17F41C000-memory.dmp
memory/1464-21-0x000001D17F419000-0x000001D17F41B000-memory.dmp
memory/1464-39-0x000001D17F411000-0x000001D17F412000-memory.dmp
memory/1464-40-0x000001D17F412000-0x000001D17F413000-memory.dmp
memory/1464-42-0x000001D17F420000-0x000001D17F421000-memory.dmp
memory/1464-44-0x000001D17F421000-0x000001D17F422000-memory.dmp
memory/1464-43-0x000001D17F414000-0x000001D17F415000-memory.dmp
memory/1464-41-0x000001D17F41E000-0x000001D17F420000-memory.dmp
memory/1464-38-0x000001D17F41C000-0x000001D17F41D000-memory.dmp
memory/1464-37-0x000001D17F41D000-0x000001D17F41E000-memory.dmp
memory/1464-45-0x000001D17F422000-0x000001D17F423000-memory.dmp
memory/1464-47-0x000001D17F423000-0x000001D17F424000-memory.dmp
memory/1464-46-0x000001D17F418000-0x000001D17F419000-memory.dmp
memory/1464-48-0x000001D131000000-0x000001D132000000-memory.dmp
memory/1464-61-0x000001D17F425000-0x000001D17F426000-memory.dmp
memory/1464-60-0x000001D131000000-0x000001D132000000-memory.dmp
memory/1464-62-0x000001D131000000-0x000001D132000000-memory.dmp
memory/1464-63-0x000001D131000000-0x000001D132000000-memory.dmp