Analysis
- max time kernel
148s - max time network
112s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
19/07/2026, 10:20
General
- Target 2026-07-19_e84e7010838bf6044648a6504ee50a25_akira_glassworm_rusty-stealer.exe
- Size 3.9MB
- Sample260719-mdbczaby4x
- SHA256 408334f4b30fa4b88511c9d70cad56f40d13d20843984ce547282d2e0bc8c189
Malware Config
Signatures
- Enumerates VirtualBox registry keys 2 TTPs 2 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Looks for VirtualBox drivers on disk 2 TTPs 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Looks for VMWare drivers on disk 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_e84e7010838bf6044648a6504ee50a25_akira_glassworm_rusty-stealer.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-19_e84e7010838bf6044648a6504ee50a25_akira_glassworm_rusty-stealer.exe"1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Checks BIOS information in registry
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4504-0-0x00007FFCAADAF000-0x00007FFCAADB0000-memory.dmp
memory/4504-1-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
memory/4504-4-0x000001F3EF740000-0x000001F3EF762000-memory.dmp
memory/4504-5-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
memory/4504-6-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
memory/4504-7-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
memory/4504-8-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
memory/4504-9-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
memory/4504-10-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
memory/4504-11-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
memory/4504-13-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
memory/4504-12-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
memory/4504-14-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
memory/4504-17-0x000001F3EF7D0000-0x000001F3EF7EE000-memory.dmp
memory/4504-18-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
memory/4504-19-0x000001F3EF7F0000-0x000001F3EF8A2000-memory.dmp
memory/4504-20-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
memory/4504-21-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
memory/4504-22-0x000001F3EF8B0000-0x000001F3EF8BA000-memory.dmp
memory/4504-24-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp