7d7e98468302f15a30f8260b1354a0ae540a8b9f37c5fb8bf637d0c444d7e2b6

Analysis

max time kernel
150s
max time network
160s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 10:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_36edbcc8b52d69e19ab076de8e392fd6_akira_amadey_elex_glassworm.exe
Size 100.0MB
Sample260720-l564aagy21
SHA256 7d7e98468302f15a30f8260b1354a0ae540a8b9f37c5fb8bf637d0c444d7e2b6
MD5 36edbcc8b52d69e19ab076de8e392fd6
SHA1 b63c72429ae34001bf4d8bd4a0f68ababda562fc
SHA512 ec9fd21499acaf3335c2f348374ebf725d69735d47a8c1e374afc6846a6eda47a840166771e3b89e1ab98bc3d076fdd715d5dfd8f063081f8ac65fc306ff0c75
SSDEEP 1572864:sxNb5tOQajYx9y+C8P6kgHpJdIxp4e1rur:kN77NrykgJip1ur
TLSH
T1BD38F12ABED578725BEED3839BD3CCBD8517900052633C9F198A17C88409B68AF7725D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution

Malware Config

Signatures

Detect binaries embedding considerable number of MFA browser extension IDs. 1 IoCs

resource	yara_rule
behavioral2/memory/4564-136-0x0000000008740000-0x0000000008758000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
behavioral2/memory/4564-136-0x0000000008740000-0x0000000008758000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/memory/4564-136-0x0000000008740000-0x0000000008758000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing bas64 encoded gzip files 1 IoCs

resource	yara_rule
behavioral2/memory/4564-136-0x0000000008740000-0x0000000008758000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File

Executes dropped EXE 1 IoCs

pid	Process
4564	ZillberRelayHost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1776	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_36edbcc8b52d69e19ab076de8e392fd6_akira_amadey_elex_glassworm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZillberRelayHost.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4076	POWERPNT.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4076	POWERPNT.EXE

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4076	POWERPNT.EXE
4076	POWERPNT.EXE
4076	POWERPNT.EXE
4076	POWERPNT.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 1776	1584	2026-07-20_36edbcc8b52d69e19ab076de8e392fd6_akira_amadey_elex_glassworm.exe	89
PID 1776 wrote to memory of 4076	1776	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-07-20_36edbcc8b52d69e19ab076de8e392fd6_akira_amadey_elex_glassworm.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_36edbcc8b52d69e19ab076de8e392fd6_akira_amadey_elex_glassworm.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\9183422b4eb5c09a.pptx"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1776
- - C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\9183422b4eb5c09a.pptx" /ou ""
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:4076

C:\ProgramData\Accounts\ae26a8eb\ZillberRelayHost.exe
C:\ProgramData\Accounts\ae26a8eb\ZillberRelayHost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9183422b4eb5c09a.pptx

Path C:\Users\Admin\AppData\Local\Temp\9183422b4eb5c09a.pptx
Size 16.1MB
SHA256 c21eef1e3a0784d34265a46771df92382311ed17dde7153bc9f4f4c8564b64e7
MD5 baf5ff518b91aba118be4f288db723a1
SHA1 46a6ab1d9e4e2f16702923794823877dea0422c6
SHA512 12db848680daef14df8ac2bb97883f3418e52b93ef991cab60d544581967d70fba23d7699e8e3b7f50609a0adf788d76e9c59da6be245a72132fd3ffb153c044
SSDEEP 393216:vI9ujzoA3fQdg8YZfmOrm4u4uJoIuGv/uzie5mRc3iYsO8aoovNel1B:vIGN3YdgVlTanXsie5JgO8xl1B
TLSH
T12C073302AD804A01D02A797ADCFE8591D3EB9DE16C61640F3BCCDD08DF459BEACDA497
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpDB04.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpDB04.tmp
Size 2KB
SHA256 0da70775627dec6e077a632a9428a1046ce4b3fb27010691c477c5b64c9f383a
MD5 82fcd9ad93ecc5028653aa104959e52a
SHA1 1f7fc9c39829ddb3aac05106449ba139c0a2c37a
SHA512 1d10109f1b110dac0aff57a5c9efc3d99bde114026e9e0e7c4c4475a37eb3c2456e3be5e30f8d154c1c6a15037d0da36451792a0e8eac86b37d59474eeebaf68
TLSH
T17F411B534B7F5C3B361AF87EB1E80EE54280BB461D89E93FF53D55488B3260A151C227
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4076-7-0x00007FFADDFF0000-0x00007FFADE000000-memory.dmp

Download

memory/4076-3-0x00007FFAE02E0000-0x00007FFAE02F0000-memory.dmp

Download

memory/4076-5-0x00007FFAE02E0000-0x00007FFAE02F0000-memory.dmp

Download

memory/4076-6-0x00007FFAE02E0000-0x00007FFAE02F0000-memory.dmp

Download

memory/4076-4-0x00007FFAE02E0000-0x00007FFAE02F0000-memory.dmp

Download

memory/4076-8-0x00007FFADDFF0000-0x00007FFADE000000-memory.dmp

Download

memory/4076-2-0x00007FFAE02E0000-0x00007FFAE02F0000-memory.dmp

Download

memory/4564-135-0x00000000087A0000-0x00000000087F4000-memory.dmp

Download

memory/4564-136-0x0000000008740000-0x0000000008758000-memory.dmp

Download

memory/4564-137-0x0000000008860000-0x00000000088AC000-memory.dmp

Download

memory/4564-148-0x0000000008960000-0x00000000089C6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads