Analysis
- max time kernel
150s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
27/07/2026, 03:44
General
- Target 2026-07-27_b086c3b3b90d3a1df20f2d072c970323_glassworm_megazord_njrat.exe
- Size 81.8MB
- Sample260727-eaf52sveph
- SHA256 bd35f4ff70ede9a9041846f5e7f4a84395cff440f563fc3463f854709dc1994b
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_b086c3b3b90d3a1df20f2d072c970323_glassworm_megazord_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-27_b086c3b3b90d3a1df20f2d072c970323_glassworm_megazord_njrat.exe"1⤵
- Downloads MZ/PE file
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "Start-Service w32time; w32tm /resync"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\w32tm.exe"C:\Windows\system32\w32tm.exe" /resync3⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C ""./_\a7f3b441-eda3-43bc-860c-b6d4b577d764.tmp""2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_\a7f3b441-eda3-43bc-860c-b6d4b577d764.tmp"./_\a7f3b441-eda3-43bc-860c-b6d4b577d764.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_\a7f3b441-eda3-43bc-860c-b6d4b577d764.tmp"./_\a7f3b441-eda3-43bc-860c-b6d4b577d764.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls5⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls5⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "w32tm /resync"5⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\w32tm.exew32tm /resync6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\_MEI42482\flet_desktop\app\flet\flet.exeC:\Users\Admin\AppData\Local\Temp\_MEI42482\flet_desktop\app\flet\flet.exe tcp://localhost:55694 C:\Users\Admin\AppData\Local\Temp\fhEuCQMtPNHYg8S0WgSK C:\Users\Admin\AppData\Local\Temp\_MEI42482\assets5⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Colorful.Console.dll
Microsoft.Win32.Primitives.dll
System.Collections.Concurrent.dll
System.Collections.NonGeneric.dll
System.Collections.dll
System.ComponentModel.Primitives.dll
System.Console.dll
System.Diagnostics.DiagnosticSource.dll
System.Diagnostics.Process.dll
System.Diagnostics.Tracing.dll
System.Drawing.Primitives.dll
System.Linq.dll
System.Memory.dll
System.Net.Http.dll
System.Net.NameResolution.dll
System.Net.NetworkInformation.dll
System.Net.Primitives.dll
System.Net.Security.dll
System.Net.Sockets.dll
System.Private.CoreLib.dll
System.Private.Uri.dll
System.Runtime.InteropServices.dll
System.Runtime.dll
System.Security.Claims.dll
System.Security.Cryptography.dll
System.Security.Principal.Windows.dll
System.Text.Json.dll
System.Threading.Channels.dll
System.Threading.Overlapped.dll
System.Threading.Thread.dll
System.Threading.ThreadPool.dll
System.Threading.dll
netstandard.dll
trigger.dll
trigger.r2r.dll
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_bz2.pyd
_ctypes.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_wmi.pyd
base_library.zip
examples-1.json
waiters-2.json
paginators-1.json
endpoint-rule-set-1.json.gz
paginators-1.json
waiters-2.json
endpoint-rule-set-1.json.gz
INSTALLER
libffi-8.dll
python3.dll
python313.dll
Conakry
Djibouti
Kigali
Lagos
Curacao
Toronto
EST
Greenwich
London
Oslo
Skopje
MET
PRC
Wallis
Yap
UCT
Mountain
select.pyd
report.txt
report.txt
report.txt
report.txt
report.txt
report.txt
report.txt
report.txt
report.txt
report.txt
report.txt
report.txt
report.txt
report.txt
memory/1856-4368-0x0000000070180000-0x000000007022B000-memory.dmp
memory/3456-5631-0x0000021982F90000-0x0000021982F91000-memory.dmp
memory/3456-5635-0x0000021982FA0000-0x0000021982FA1000-memory.dmp
memory/3456-5639-0x00007FFB9C730000-0x00007FFB9E838000-memory.dmp
memory/3456-5632-0x0000021985BF0000-0x0000021986CF5000-memory.dmp
memory/3456-5634-0x0000021985BF0000-0x0000021986CF5000-memory.dmp
memory/3456-5633-0x0000021985BF0000-0x0000021986CF5000-memory.dmp
memory/3752-227-0x00007FFBAEE80000-0x00007FFBAF824000-memory.dmp
memory/3752-232-0x00007FFBAEE80000-0x00007FFBAF824000-memory.dmp
memory/3752-231-0x00007FFBAEE80000-0x00007FFBAF824000-memory.dmp
memory/3752-224-0x00007FFBAF00F000-0x00007FFBAF010000-memory.dmp
memory/3752-234-0x00007FFBAEE80000-0x00007FFBAF824000-memory.dmp
memory/3752-228-0x000001FFBB330000-0x000001FFBB352000-memory.dmp
memory/3752-229-0x00007FFBAEE80000-0x00007FFBAF824000-memory.dmp
memory/3752-230-0x00007FFBAEE80000-0x00007FFBAF824000-memory.dmp