131c5fe483dcb73f23809727022ae58a4536122a0c2481b0e96a9b867e32e882

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 22:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_772b98b611922c80197dac3cb4ed7184_akira_glassworm_rusty-stealer.exe
Size 8.8MB
Sample260717-2bsa2abw3w
SHA256 131c5fe483dcb73f23809727022ae58a4536122a0c2481b0e96a9b867e32e882
MD5 772b98b611922c80197dac3cb4ed7184
SHA1 1565cfc4fc5f598ef4fd3f786c3f5e642ba733e9
SHA512 9fc4c129a5c84ce94e5f0c590e9efdaba8cf71f114f7228c5535d7670f15698e04db3712ff5020b9f902d081f4caebd64eecb441beb3411adf394e771cddd35d
SSDEEP 98304:HNewpTr05Mdj2adJcCLUjJQgCX1tbjX8EJZ3VIWfDY:HkwTeM5xdJNvgCXH/CWrY
TLSH
T15896D82AA77950D9C17FC0B892835F22BD21749A07393BF749C1866A2F20EF86D3D754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

persistence

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
behavioral2/files/0x000700000001b89b-3.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Executes dropped EXE 3 IoCs

pid	Process
2236	bin.exe
3224	MicrosoftServices.exe
5492	MicrosoftServices.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftServices = "C:\\Users\\Admin\\.test\\MicrosoftServices\\MicrosoftServices.exe "	2026-07-17_772b98b611922c80197dac3cb4ed7184_akira_glassworm_rusty-stealer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	bin.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5492	MicrosoftServices.exe
5492	MicrosoftServices.exe
5492	MicrosoftServices.exe
5492	MicrosoftServices.exe
5492	MicrosoftServices.exe
5492	MicrosoftServices.exe
5492	MicrosoftServices.exe
5492	MicrosoftServices.exe
5492	MicrosoftServices.exe
5492	MicrosoftServices.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5492	MicrosoftServices.exe
5492	MicrosoftServices.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 2236	4572	2026-07-17_772b98b611922c80197dac3cb4ed7184_akira_glassworm_rusty-stealer.exe	90
PID 2236 wrote to memory of 5832	2236	bin.exe	91
PID 4572 wrote to memory of 3224	4572	2026-07-17_772b98b611922c80197dac3cb4ed7184_akira_glassworm_rusty-stealer.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-07-17_772b98b611922c80197dac3cb4ed7184_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_772b98b611922c80197dac3cb4ed7184_akira_glassworm_rusty-stealer.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Users\Admin\AppData\Local\Temp\bin.exe
  "C:\Users\Admin\AppData\Local\Temp\bin.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2236
- - C:\Windows\System32\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:5832
- C:\Users\Admin\.test\MicrosoftServices\MicrosoftServices.exe
  "C:\Users\Admin\.test\MicrosoftServices\MicrosoftServices.exe"
  2⤵
  - Executes dropped EXE
  PID:3224

C:\Users\Admin\.test\MicrosoftServices\MicrosoftServices.exe
C:\Users\Admin\.test\MicrosoftServices\MicrosoftServices.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftServices.exe

Path C:\Users\Admin\.test\MicrosoftServices\MicrosoftServices.exe
Size 8.8MB
SHA256 131c5fe483dcb73f23809727022ae58a4536122a0c2481b0e96a9b867e32e882
MD5 772b98b611922c80197dac3cb4ed7184
SHA1 1565cfc4fc5f598ef4fd3f786c3f5e642ba733e9
SHA512 9fc4c129a5c84ce94e5f0c590e9efdaba8cf71f114f7228c5535d7670f15698e04db3712ff5020b9f902d081f4caebd64eecb441beb3411adf394e771cddd35d
SSDEEP 98304:HNewpTr05Mdj2adJcCLUjJQgCX1tbjX8EJZ3VIWfDY:HkwTeM5xdJNvgCXH/CWrY
TLSH
T15896D82AA77950D9C17FC0B892835F22BD21749A07393BF749C1866A2F20EF86D3D754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bin.exe

Path C:\Users\Admin\AppData\Local\Temp\bin.exe
Size 44KB
SHA256 9c2c8a8588fe6db09c09337e78437cb056cd557db1bcf5240112cbfb7b600efb
MD5 2f82623f9523c0d167862cad0eff6806
SHA1 5d77804b87735e66d7d1e263c31c4ef010f16153
SHA512 7fe8285e52355f2e53650dc4176f62299b8185ed7188850e0a566ddef7e77e1e88511bdcf6f478c938acef3d61d8b269e218970134e1ffc5581f8c7be750c330
SSDEEP 384:OtF1XO9GxgL7ol+WSvYWCiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiLiiiiiriM:QOOgL7E4r
TLSH
T144131A677F6A2AD4DC2182F41F11070A5A20AFD6331B0FBB314B7091DA35DE29DA9BD0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download