Overview

overview

10

Static

static

3

2026-07-18...uk.exe

windows10-2004-x64

7

2026-07-18...uk.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    145s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    18/07/2026, 18:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-18_8681d3638535dd7e3d921c3ecbae9b94_akira_glassworm_icedid_megazord_njrat_rusty-stealer_ryuk.exe
  • Size 2.7MB
  • Sample260718-w1brpac141
  • SHA256 2e9028234b67bce296532b812a5f11265e074f10b4597888c2cbd1e608d9e5de
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoveryexecutionpersistence

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    1⤵
      PID:1752
      • C:\Users\Admin\AppData\Local\Temp\2026-07-18_8681d3638535dd7e3d921c3ecbae9b94_akira_glassworm_icedid_megazord_njrat_rusty-stealer_ryuk.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-07-18_8681d3638535dd7e3d921c3ecbae9b94_akira_glassworm_icedid_megazord_njrat_rusty-stealer_ryuk.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Checks BIOS information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1420
        • C:\Windows\system32\schtasks.exe
          "schtasks" /Query /TN "\Microsoft\Windows\Device Information\DeviceCensusHelper"
          3⤵
            PID:2268
          • C:\Windows\system32\schtasks.exe
            "schtasks" /Query /TN "\Microsoft\Windows\Device Information\DeviceCensusHelper"
            3⤵
              PID:2908
            • C:\Windows\system32\schtasks.exe
              "schtasks" /Query /TN "\Microsoft\Windows\Device Information\DeviceCensusHelper"
              3⤵
                PID:5648
            • C:\Windows\System32\wscript.exe
              C:\Windows\System32\wscript.exe //B C:\Users\Admin\AppData\Local\Temp\tmp\mu9waxlouna3\worker.vbs C:\Users\Admin\AppData\Local\Temp\2026-07-18_8681d3638535dd7e3d921c3ecbae9b94_akira_glassworm_icedid_megazord_njrat_rusty-stealer_ryuk.exe C:\Users\Admin\AppData\Local\Temp\tmp\mu9waxlouna3\exit.signal C:\Users\Admin\AppData\Local\Temp\tmp\mu9waxlouna3
              2⤵
              • Executes a VBScript file via the Windows Script Host.
              • Suspicious use of WriteProcessMemory
              PID:5860
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /c start "" /b "dumpchk.exe"
                3⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:4884
                • C:\ProgramData\Verification\dumpchk.exe
                  "dumpchk.exe"
                  4⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2984
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 31 >nul & rd /s /q "C:\Users\Admin\AppData\Local\Temp\tmp\mu9waxlouna3"
                3⤵
                • Executes a command shell one-liner
                • System Network Configuration Discovery: Internet Connection Discovery
                • Suspicious use of WriteProcessMemory
                PID:6020
                • C:\Windows\system32\PING.EXE
                  ping 127.0.0.1 -n 31
                  4⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:3464
          • C:\ProgramData\Verification\dumpchk.exe
            "C:\ProgramData\Verification\dumpchk.exe"
            1⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:5852
            • C:\Windows\system32\dllhost.exe
              "C:\Windows\system32\dllhost.exe"
              2⤵
                PID:3304

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  dbgeng.dll
                  • Path C:\ProgramData\Verification\dbgeng.dll
                  • Size 1.4MB
                  • SHA256 61b2c0b37dd8bafb0648729fedd865d8efb35a1e6c23c1708d0878bc18f7f66d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  dumpchk.exe
                  • Path C:\ProgramData\Verification\dumpchk.exe
                  • Size 37KB
                  • SHA256 e1b935b93ea56433944200218e9bd8e67a9d7c26b829d45681e0042ed77db608
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  worker.vbs
                  • Path C:\Users\Admin\AppData\Local\Temp\tmp\mu9waxlouna3\worker.vbs
                  • Size 914B
                  • SHA256 efc36fb2178ee0f52751fe0bf1ced905f7f5df9027ff9b7afccf53ae5a18c831
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  memory/2984-12-0x0000024F212E0000-0x0000024F21305000-memory.dmp
                  Download

                  memory/3304-15-0x00000213D4EC0000-0x00000213D4FE9000-memory.dmp
                  Download

                  memory/3304-16-0x00000213D6F30000-0x00000213D7165000-memory.dmp
                  Download