Overview

overview

10

Static

static

3

2026-07-18...uk.exe

windows10-2004-x64

7

2026-07-18...uk.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    142s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    18/07/2026, 01:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-18_1d92a7c12927770a23a90771e523be37_akira_glassworm_icedid_megazord_njrat_rusty-stealer_ryuk.exe
  • Size 2.7MB
  • Sample260718-bk6lxaft21
  • SHA256 0139bb6bd4d6b59fbe4e8554845361a9483ff71f71c0214072b04d42a2fa6026
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoveryexecutionpersistence

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    1⤵
      PID:552
      • C:\Users\Admin\AppData\Local\Temp\2026-07-18_1d92a7c12927770a23a90771e523be37_akira_glassworm_icedid_megazord_njrat_rusty-stealer_ryuk.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-07-18_1d92a7c12927770a23a90771e523be37_akira_glassworm_icedid_megazord_njrat_rusty-stealer_ryuk.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Checks BIOS information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4256
        • C:\Windows\system32\schtasks.exe
          "schtasks" /Query /TN "\Microsoft\Windows\Device Information\DeviceCensusHelper"
          3⤵
            PID:4112
          • C:\Windows\system32\schtasks.exe
            "schtasks" /Query /TN "\Microsoft\Windows\Device Information\DeviceCensusHelper"
            3⤵
              PID:3212
            • C:\Windows\system32\schtasks.exe
              "schtasks" /Query /TN "\Microsoft\Windows\Device Information\DeviceCensusHelper"
              3⤵
                PID:1044
              • C:\Windows\system32\schtasks.exe
                "schtasks" /Run /TN "\Microsoft\Windows\Device Information\DeviceCensusHelper"
                3⤵
                  PID:1704
              • C:\Windows\System32\wscript.exe
                C:\Windows\System32\wscript.exe //B C:\Users\Admin\AppData\Local\Temp\tmp\w5ygxq6hzjqv\worker.vbs C:\Users\Admin\AppData\Local\Temp\2026-07-18_1d92a7c12927770a23a90771e523be37_akira_glassworm_icedid_megazord_njrat_rusty-stealer_ryuk.exe C:\Users\Admin\AppData\Local\Temp\tmp\w5ygxq6hzjqv\exit.signal C:\Users\Admin\AppData\Local\Temp\tmp\w5ygxq6hzjqv
                2⤵
                • Executes a VBScript file via the Windows Script Host.
                • Suspicious use of WriteProcessMemory
                PID:4892
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c start "" /b "dumpchk.exe"
                  3⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:1560
                  • C:\ProgramData\Verification\dumpchk.exe
                    "dumpchk.exe"
                    4⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4564
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 31 >nul & rd /s /q "C:\Users\Admin\AppData\Local\Temp\tmp\w5ygxq6hzjqv"
                  3⤵
                  • Executes a command shell one-liner
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:5960
                  • C:\Windows\system32\PING.EXE
                    ping 127.0.0.1 -n 31
                    4⤵
                    • System Network Configuration Discovery: Internet Connection Discovery
                    • Runs ping.exe
                    PID:1160
            • C:\ProgramData\Verification\dumpchk.exe
              "C:\ProgramData\Verification\dumpchk.exe"
              1⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:5516
              • C:\Windows\system32\dllhost.exe
                "C:\Windows\system32\dllhost.exe"
                2⤵
                  PID:5468
              • C:\ProgramData\Verification\dumpchk.exe
                "C:\ProgramData\Verification\dumpchk.exe"
                1⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious behavior: EnumeratesProcesses
                PID:1476

              Network

                    MITRE ATT&CK Enterprise v16

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    dbgeng.dll
                    • Path C:\ProgramData\Verification\dbgeng.dll
                    • Size 1.4MB
                    • SHA256 22268b8c56a36d69aa88d8680ba4ea44230cfa10597ed451db14e265a0e1b45a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    dumpchk.exe
                    • Path C:\ProgramData\Verification\dumpchk.exe
                    • Size 37KB
                    • SHA256 e1b935b93ea56433944200218e9bd8e67a9d7c26b829d45681e0042ed77db608
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    worker.vbs
                    • Path C:\Users\Admin\AppData\Local\Temp\tmp\w5ygxq6hzjqv\worker.vbs
                    • Size 914B
                    • SHA256 efc36fb2178ee0f52751fe0bf1ced905f7f5df9027ff9b7afccf53ae5a18c831
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    memory/4564-12-0x000001F9EBA10000-0x000001F9EBA2D000-memory.dmp
                    Download

                    memory/4564-13-0x000001F9ED270000-0x000001F9ED296000-memory.dmp
                    Download

                    memory/5468-16-0x0000027F029B0000-0x0000027F02AD9000-memory.dmp
                    Download

                    memory/5468-18-0x0000027F04AE0000-0x0000027F04D15000-memory.dmp
                    Download