b93ee4d95954ab9c42efb69633f7f5eb42c0aba58ca795137a1b8617d7b65cf8

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 02:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_b066befac4390f0477249bccff84bc2b_akira_glassworm_rusty-stealer.exe
Size 11.5MB
Sample260801-c9s8jsce35
SHA256 b93ee4d95954ab9c42efb69633f7f5eb42c0aba58ca795137a1b8617d7b65cf8
MD5 b066befac4390f0477249bccff84bc2b
SHA1 952d1773d2b840f9973a486c6d81bdb551001b9c
SHA512 71fea926b2fc26410ad6dc17af9b50db62164ca1268dd1b98e2b9aa72c8892a58ea7ff14ac7656f42ae1f919f9693319a0630825b87a4e7f3c00ed3117f44b02
SSDEEP 98304:IyE4MjdalU0EdZhINYDi/TUCSzAQdrUZ/qouGSi95:G0HUd4V
TLSH
T164C62812BBAA98ACD59AC474C3568A635A3134CE0B35B9FF45C482343F69AF45F3C718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

execution persistence

Malware Config

Signatures

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c645-2.dat	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Executes dropped EXE 1 IoCs

pid	Process
1892	MicrosoftComponents.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3276	schtasks.exe
1244	schtasks.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 4356	1152	2026-08-01_b066befac4390f0477249bccff84bc2b_akira_glassworm_rusty-stealer.exe	88
PID 1152 wrote to memory of 3276	1152	2026-08-01_b066befac4390f0477249bccff84bc2b_akira_glassworm_rusty-stealer.exe	90
PID 1152 wrote to memory of 1892	1152	2026-08-01_b066befac4390f0477249bccff84bc2b_akira_glassworm_rusty-stealer.exe	92
PID 1892 wrote to memory of 4604	1892	MicrosoftComponents.exe	93
PID 1892 wrote to memory of 1244	1892	MicrosoftComponents.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-01_b066befac4390f0477249bccff84bc2b_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_b066befac4390f0477249bccff84bc2b_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\system32\fltmc.exe
  "fltmc"
  2⤵
  PID:4356
- C:\Windows\system32\schtasks.exe
  "schtasks" /Create /TN MicrosoftEdgeUpdateTask /XML C:\Users\Admin\AppData\Local\Temp\task_temp.xml /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3276
- C:\Microsoft Components\MicrosoftComponents.exe
  "C:\Microsoft Components\MicrosoftComponents.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1892
- - C:\Windows\system32\fltmc.exe
    "fltmc"
    3⤵
    PID:4604
- - C:\Windows\system32\schtasks.exe
    "schtasks" /Create /TN MicrosoftEdgeUpdateTask /XML C:\Users\Admin\AppData\Local\Temp\task_temp.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftComponents.exe

Path C:\Microsoft Components\MicrosoftComponents.exe
Size 11.5MB
SHA256 b93ee4d95954ab9c42efb69633f7f5eb42c0aba58ca795137a1b8617d7b65cf8
MD5 b066befac4390f0477249bccff84bc2b
SHA1 952d1773d2b840f9973a486c6d81bdb551001b9c
SHA512 71fea926b2fc26410ad6dc17af9b50db62164ca1268dd1b98e2b9aa72c8892a58ea7ff14ac7656f42ae1f919f9693319a0630825b87a4e7f3c00ed3117f44b02
SSDEEP 98304:IyE4MjdalU0EdZhINYDi/TUCSzAQdrUZ/qouGSi95:G0HUd4V
TLSH
T164C62812BBAA98ACD59AC474C3568A635A3134CE0B35B9FF45C482343F69AF45F3C718
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

task_temp.xml

Path C:\Users\Admin\AppData\Local\Temp\task_temp.xml
Size 1KB
SHA256 7875b697424fa3f3ff1658f125c97c16a3bfd590ea166af3c77d2ebe7386626e
MD5 baa49d91686afe9ca834bef0df6fdf7d
SHA1 b48c96c8c05845bea27534f604b6a056f838475c
SHA512 6bfcbc5b5163765b039515b13acc018216e7abcbaf4aa605da738583876bbd52823bf81074ee92294a22585e592ce1c754ba4d0d47c0111e4d7198d4bb7a8f18
TLSH
T16C313443A7FE2109F0F35B9CAABA54119E77BD581D34D07D00AC060D0BB3962C9A0B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads