Analysis
- max time kernel
148s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
27/07/2026, 03:44
General
- Target 2026-07-27_b086c3b3b90d3a1df20f2d072c970323_glassworm_megazord_njrat.exe
- Size 81.8MB
- Sample260727-eaf52sveph
- SHA256 bd35f4ff70ede9a9041846f5e7f4a84395cff440f563fc3463f854709dc1994b
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Downloads MZ/PE file 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_b086c3b3b90d3a1df20f2d072c970323_glassworm_megazord_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-27_b086c3b3b90d3a1df20f2d072c970323_glassworm_megazord_njrat.exe"1⤵
- Downloads MZ/PE file
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "Start-Service w32time; w32tm /resync"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\w32tm.exe"C:\Windows\system32\w32tm.exe" /resync3⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C ""./_\cfebfc59-7f5a-410a-9e5a-29580a47f1ec.tmp""2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_\cfebfc59-7f5a-410a-9e5a-29580a47f1ec.tmp"./_\cfebfc59-7f5a-410a-9e5a-29580a47f1ec.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_\cfebfc59-7f5a-410a-9e5a-29580a47f1ec.tmp"./_\cfebfc59-7f5a-410a-9e5a-29580a47f1ec.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls5⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls5⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "w32tm /resync"5⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\w32tm.exew32tm /resync6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\_MEI34722\flet_desktop\app\flet\flet.exeC:\Users\Admin\AppData\Local\Temp\_MEI34722\flet_desktop\app\flet\flet.exe tcp://localhost:55612 C:\Users\Admin\AppData\Local\Temp\jVCmOMdtHIIKzQfFRkqW C:\Users\Admin\AppData\Local\Temp\_MEI34722\assets5⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Colorful.Console.dll
Microsoft.Win32.Primitives.dll
System.Collections.Concurrent.dll
System.Collections.NonGeneric.dll
System.Collections.dll
System.ComponentModel.Primitives.dll
System.Console.dll
System.Diagnostics.DiagnosticSource.dll
System.Diagnostics.Process.dll
System.Diagnostics.Tracing.dll
System.Drawing.Primitives.dll
System.Linq.dll
System.Memory.dll
System.Net.Http.dll
System.Net.NameResolution.dll
System.Net.NetworkInformation.dll
System.Net.Primitives.dll
System.Net.Security.dll
System.Net.Sockets.dll
System.Private.CoreLib.dll
System.Private.Uri.dll
System.Runtime.InteropServices.dll
System.Runtime.dll
System.Security.Claims.dll
System.Security.Cryptography.dll
System.Security.Principal.Windows.dll
System.Text.Json.dll
System.Threading.Channels.dll
System.Threading.Overlapped.dll
System.Threading.Thread.dll
System.Threading.ThreadPool.dll
System.Threading.dll
netstandard.dll
trigger.dll
trigger.r2r.dll
81d243bd2c585b0f4821__mypyc.cp313-win_amd64.pyd
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_lzma.pyd
base_library.zip
examples-1.json
waiters-2.json
paginators-1.json
endpoint-rule-set-1.json.gz
paginators-1.json
waiters-2.json
endpoint-rule-set-1.json.gz
INSTALLER
freetype.dll
libcrypto-3.dll
libffi-8.dll
libjpeg-9.dll
libmodplug-1.dll
libogg-0.dll
libopus-0.dll
libopusfile-0.dll
libpng16-16.dll
libssl-3.dll
python3.dll
python313.dll
Conakry
Djibouti
Kigali
Lagos
Curacao
Toronto
EST
Greenwich
London
Oslo
Skopje
MET
PRC
Wallis
Yap
UCT
Mountain
__PSScriptPolicyTest_zdd004m4.w1m.ps1
report.txt
memory/3240-5470-0x000001AA17EE0000-0x000001AA17EE1000-memory.dmp
memory/3240-5474-0x000001AA17EF0000-0x000001AA17EF1000-memory.dmp
memory/3240-5471-0x000001AA18070000-0x000001AA19175000-memory.dmp
memory/3240-5472-0x000001AA18070000-0x000001AA19175000-memory.dmp
memory/3240-5473-0x000001AA18070000-0x000001AA19175000-memory.dmp
memory/3240-5480-0x00007FFA23310000-0x00007FFA25418000-memory.dmp
memory/3536-4379-0x0000000062E80000-0x0000000062EA4000-memory.dmp
memory/3536-4378-0x0000000070180000-0x000000007022B000-memory.dmp
memory/3536-4380-0x0000023F59530000-0x0000023F5A8B1000-memory.dmp
memory/4452-234-0x000001BAA48A0000-0x000001BAA48B0000-memory.dmp
memory/4452-224-0x000001BAA48A0000-0x000001BAA48B0000-memory.dmp
memory/4452-231-0x000001BAA49B0000-0x000001BAA49D2000-memory.dmp
memory/4452-225-0x000001BAA48A0000-0x000001BAA48B0000-memory.dmp