Analysis
- max time kernel
148s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
21/07/2026, 05:41
General
- Target 2026-07-21_9eb9ddf2b037b58261fcce46e52c7034_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe
- Size 93.3MB
- Sample260721-gdfd2ahs7s
- SHA256 35a86cef01291e01b808c51667f66608ddff39cd75deb2e895e217be2cbcfed3
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Maps connected drives based on registry 3 TTPs 3 IoCs
Disk information is often read in order to detect sandboxing environments.
- Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 24 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9eb9ddf2b037b58261fcce46e52c7034_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-21_9eb9ddf2b037b58261fcce46e52c7034_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe"1⤵
- Checks computer location settings
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1688-0-0x000001DA7EC32000-0x000001DA7EC33000-memory.dmp
memory/1688-1-0x000001DA7EC30000-0x000001DA7EC31000-memory.dmp
memory/1688-3-0x000001DA7EC33000-0x000001DA7EC34000-memory.dmp
memory/1688-4-0x000001DA7EC35000-0x000001DA7EC36000-memory.dmp
memory/1688-5-0x000001DA7EC31000-0x000001DA7EC32000-memory.dmp
memory/1688-2-0x000001DA7EC34000-0x000001DA7EC35000-memory.dmp
memory/1688-6-0x000001DA7EC37000-0x000001DA7EC38000-memory.dmp
memory/1688-35-0x000001DA7EC36000-0x000001DA7EC37000-memory.dmp
memory/1688-36-0x000001DA7EC41000-0x000001DA7EC42000-memory.dmp
memory/1688-37-0x000001DA3B000000-0x000001DA3B200000-memory.dmp
memory/1688-38-0x000001DA3B000000-0x000001DA3B200000-memory.dmp
memory/1688-39-0x000001DA3B000000-0x000001DA3B200000-memory.dmp
memory/1688-42-0x000001DAC4400000-0x000001DAC4600000-memory.dmp
memory/1688-45-0x000001DA7EC43000-0x000001DA7EC44000-memory.dmp
memory/1688-44-0x000001DAC4400000-0x000001DAC4600000-memory.dmp
memory/1688-43-0x000001DAC4400000-0x000001DAC4600000-memory.dmp
memory/1688-41-0x000001DAC4400000-0x000001DAC4600000-memory.dmp
memory/1688-40-0x000001DAC4400000-0x000001DAC4600000-memory.dmp
memory/1688-61-0x000001DA7EC44000-0x000001DA7EC45000-memory.dmp
memory/1688-67-0x000001DA7EC45000-0x000001DA7EC46000-memory.dmp
memory/1688-71-0x000001DA7EC47000-0x000001DA7EC48000-memory.dmp
memory/1688-76-0x000001DAC4400000-0x000001DAC4600000-memory.dmp
memory/1688-75-0x000001DA7EC50000-0x000001DA7EC51000-memory.dmp
memory/1688-74-0x000001DAC4400000-0x000001DAC4600000-memory.dmp
memory/1688-73-0x000001DA7EC42000-0x000001DA7EC43000-memory.dmp
memory/1688-72-0x000001DAC4400000-0x000001DAC4600000-memory.dmp
memory/1688-70-0x000001DABEE00000-0x000001DABF000000-memory.dmp
memory/1688-69-0x000001DABEE00000-0x000001DABF000000-memory.dmp
memory/1688-68-0x000001DABEE00000-0x000001DABF000000-memory.dmp
memory/1688-66-0x000001DABEE00000-0x000001DABF000000-memory.dmp
memory/1688-65-0x000001DABEE00000-0x000001DABF000000-memory.dmp
memory/1688-64-0x000001DA7EC51000-0x000001DA7EC52000-memory.dmp
memory/1688-63-0x000001DA7EC4D000-0x000001DA7EC50000-memory.dmp
memory/1688-62-0x000001DA3B000000-0x000001DA3B200000-memory.dmp
memory/1688-60-0x000001DA3B000000-0x000001DA3B200000-memory.dmp
memory/1688-59-0x000001DA7EC4B000-0x000001DA7EC4C000-memory.dmp
memory/1688-58-0x000001DA7EC4C000-0x000001DA7EC4D000-memory.dmp
memory/1688-57-0x000001DAC4400000-0x000001DAC4600000-memory.dmp
memory/1688-77-0x000001DA7EC32000-0x000001DA7EC33000-memory.dmp
memory/1688-78-0x000001DA7EC52000-0x000001DA7EC54000-memory.dmp