a71ebc52aebd14da6926870dbde3ac58de45475de2de9f2d4cd31c414f0e0f18

General

Target
2026-08-02_5e71a0105d2d8bc48cc5d37ba9fea0b8_akira_amadey_elex_glassworm.exe
Size 8.1MB
Sample260802-dmembacl3x
SHA256 a71ebc52aebd14da6926870dbde3ac58de45475de2de9f2d4cd31c414f0e0f18
MD5 5e71a0105d2d8bc48cc5d37ba9fea0b8
SHA1 7dc37c18b170528d8abef499cec714d112eb8534
SHA512 b7d253bb222fd4d63bf517b3e876d5f9d609fd570dbb180920f055b095e6ef798f561d584b3428674b2609234cf8dac3acbc3e9dd7a3874e9a932c4bac209676
SSDEEP 196608:IucRm94C0KOkK42TWM78PhxP/zQVyI7oHvr7Yp4Qexsw:IucRmGOfKNqM7sD/zQVyI7UIp4QUsw
TLSH
T1AA863362B741983AD58740319018E774953A4EB933095EC3C2F8BE94AD737D58B32BBE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

backdoor defense_evasion discovery execution rat

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	rustdesk.exe

Executes dropped EXE 3 IoCs

pid	Process
3236	rustdesk.exe
540	rustdesk.exe
116	rustdesk.exe

Loads dropped DLL 2 IoCs

pid	Process
3236	rustdesk.exe
3236	rustdesk.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1460	icacls.exe
4652	icacls.exe

RustDesk remote access tool
RustDesk is an open-source remote admin tool.
backdoor rat

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\RustDesk\log\rustdesk_rCURRENT.log	rustdesk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3520	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_5e71a0105d2d8bc48cc5d37ba9fea0b8_akira_amadey_elex_glassworm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rustdesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rustdesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rustdesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
640	taskkill.exe
4592	taskkill.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3236	rustdesk.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3236	rustdesk.exe
540	rustdesk.exe
540	rustdesk.exe
116	rustdesk.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	640	taskkill.exe
Token: SeDebugPrivilege	540	rustdesk.exe
Token: SeDebugPrivilege	4592	taskkill.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3236	rustdesk.exe
3236	rustdesk.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3572 wrote to memory of 640	3572	2026-08-02_5e71a0105d2d8bc48cc5d37ba9fea0b8_akira_amadey_elex_glassworm.exe	87
PID 3572 wrote to memory of 3236	3572	2026-08-02_5e71a0105d2d8bc48cc5d37ba9fea0b8_akira_amadey_elex_glassworm.exe	90
PID 3236 wrote to memory of 4652	3236	rustdesk.exe	91
PID 3236 wrote to memory of 1460	3236	rustdesk.exe	92
PID 3236 wrote to memory of 540	3236	rustdesk.exe	96
PID 3236 wrote to memory of 3520	3236	rustdesk.exe	97
PID 3520 wrote to memory of 4592	3520	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-08-02_5e71a0105d2d8bc48cc5d37ba9fea0b8_akira_amadey_elex_glassworm.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_5e71a0105d2d8bc48cc5d37ba9fea0b8_akira_amadey_elex_glassworm.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3572
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill" /F /IM RuntimeBroker_rustdesk.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:640
- C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
  "C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3236
- - C:\Windows\SysWOW64\icacls.exe
    "icacls" C:\ProgramData\RustDesk /grant *S-1-1-0:(OI)(CI)F /T
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:4652
- - C:\Windows\SysWOW64\icacls.exe
    "icacls" C:\ProgramData\RustDesk\shared_memory_portable_service /grant *S-1-1-0:(OI)(CI)F /T
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:1460
- - C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
    "C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe" --portable-service
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:540
  - - C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
      "C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe" --run-as-system
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:116
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /c "taskkill /F /IM RuntimeBroker_rustdesk.exe"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3520
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM RuntimeBroker_rustdesk.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

shared_memory_portable_service

Path C:\ProgramData\RustDesk\shared_memory_portable_service
Size 23B
SHA256 ac16a217f95380b986ec16c4353f25a5e6b0a8401ad318062ddebc3a66620bab
MD5 7b5598b556e0bd8b949581da3d7c0462
SHA1 97e0504e74a28628514d123e7cbc1fe45d523e9b
SHA512 0fd24166e809bdad7bae13ceef029a4db0b4b2f6a860fe0f7d1efa6582e3499ae5aa827d4152a1ce1cff6974b8da658ad364a78266b0d77e5d340a62fbd664c6
MD5 SHA1 SHA512

Submit Download

rustdesk.exe

Path C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
Size 18.1MB
SHA256 15c7f7197bc5ed8f3d4bd3253e5a23185df6f98e9e2f81944290714eb47229ba
MD5 6b50fc869ed4d5dd295d3d16b342f03a
SHA1 2c32af135809891e0171f54b9fa3d23af66aa0b7
SHA512 7ca6e9697cf1a4236597016ab08c23bfff18d9e6179725d1e4cb2884e6b745230194517cee5e239d0aae36c3769b7ac24a8d19a96710ef7bc7131744d46c6355
SSDEEP 393216:UqC9v7OQjqvpBQa2qCDfXjmaGwdYY/ltVOmsFoVt/FmehZYLKo2qVwf4vq81Z8S:LC9v7Ha25jmaGwdDlrOmsFoVt/FmehZk
TLSH
T19117AF41F78361B5D8860870116FB6BA57382D394328CAF7E7E47D35E4356E22A39F0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sciter.dll

Path C:\Users\Admin\AppData\Local\rustdesk\sciter.dll
Size 5.8MB
SHA256 285f3e6a051a7c61845cd7e4d2120781b6bdf411239f70a85c65b38a52d38f28
MD5 fc2311ca280c197f5ed16def6d464b6b
SHA1 0c0957c2db583a080010e63da9184a9ea1184b76
SHA512 8400ec74282f16caafcbcecf46cb289829ecaeeee400a5114c13751e83fb1bb660bb64a6961b612489bc764a711c40dcdecc4f835ce0dc4f1d602f2d67f75719
SSDEEP 98304:sKwCpE+mBoEBDeasdzH/cs8cfQW6OUiCpIWLQCIFBRQlt3RHffOYVvsIrqNkJW6t:sKL/ERqH/TQW6OKuWL6FERAIrqNp/8
TLSH
T19356AF23BB95803DC42F02B06E6EF37D81FABE7005B0412B2BB87E5D6EB09E15655563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads