a71ebc52aebd14da6926870dbde3ac58de45475de2de9f2d4cd31c414f0e0f18

General

Target
2026-08-02_5e71a0105d2d8bc48cc5d37ba9fea0b8_akira_amadey_elex_glassworm.exe
Size 8.1MB
Sample260802-dmembacl3x
SHA256 a71ebc52aebd14da6926870dbde3ac58de45475de2de9f2d4cd31c414f0e0f18
MD5 5e71a0105d2d8bc48cc5d37ba9fea0b8
SHA1 7dc37c18b170528d8abef499cec714d112eb8534
SHA512 b7d253bb222fd4d63bf517b3e876d5f9d609fd570dbb180920f055b095e6ef798f561d584b3428674b2609234cf8dac3acbc3e9dd7a3874e9a932c4bac209676
SSDEEP 196608:IucRm94C0KOkK42TWM78PhxP/zQVyI7oHvr7Yp4Qexsw:IucRmGOfKNqM7sD/zQVyI7UIp4QUsw
TLSH
T1AA863362B741983AD58740319018E774953A4EB933095EC3C2F8BE94AD737D58B32BBE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

backdoor defense_evasion discovery execution rat

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
5828	rustdesk.exe
4324	rustdesk.exe
5500	rustdesk.exe

Loads dropped DLL 2 IoCs

pid	Process
5828	rustdesk.exe
5828	rustdesk.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2220	icacls.exe
4344	icacls.exe

RustDesk remote access tool
RustDesk is an open-source remote admin tool.
backdoor rat

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\RustDesk\log\rustdesk_rCURRENT.log	rustdesk.exe
File opened for modification	C:\Windows\SystemTemp\shared_memory-rs\shmem_C1BF2C025485452	rustdesk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4476	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rustdesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rustdesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rustdesk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_5e71a0105d2d8bc48cc5d37ba9fea0b8_akira_amadey_elex_glassworm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
3304	taskkill.exe
900	taskkill.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5828	rustdesk.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5828	rustdesk.exe
4324	rustdesk.exe
4324	rustdesk.exe
5500	rustdesk.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3304	taskkill.exe
Token: SeDebugPrivilege	4324	rustdesk.exe
Token: SeDebugPrivilege	900	taskkill.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5828	rustdesk.exe
5828	rustdesk.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 472 wrote to memory of 3304	472	2026-08-02_5e71a0105d2d8bc48cc5d37ba9fea0b8_akira_amadey_elex_glassworm.exe	89
PID 472 wrote to memory of 5828	472	2026-08-02_5e71a0105d2d8bc48cc5d37ba9fea0b8_akira_amadey_elex_glassworm.exe	92
PID 5828 wrote to memory of 4344	5828	rustdesk.exe	93
PID 5828 wrote to memory of 2220	5828	rustdesk.exe	94
PID 5828 wrote to memory of 4324	5828	rustdesk.exe	97
PID 5828 wrote to memory of 4476	5828	rustdesk.exe	99
PID 4476 wrote to memory of 900	4476	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-02_5e71a0105d2d8bc48cc5d37ba9fea0b8_akira_amadey_elex_glassworm.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_5e71a0105d2d8bc48cc5d37ba9fea0b8_akira_amadey_elex_glassworm.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:472
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill" /F /IM RuntimeBroker_rustdesk.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3304
- C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
  "C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5828
- - C:\Windows\SysWOW64\icacls.exe
    "icacls" C:\ProgramData\RustDesk /grant *S-1-1-0:(OI)(CI)F /T
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:4344
- - C:\Windows\SysWOW64\icacls.exe
    "icacls" C:\ProgramData\RustDesk\shared_memory_portable_service /grant *S-1-1-0:(OI)(CI)F /T
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:2220
- - C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
    "C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe" --portable-service
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4324
  - - C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
      "C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe" --run-as-system
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5500
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /c "taskkill /F /IM RuntimeBroker_rustdesk.exe"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4476
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM RuntimeBroker_rustdesk.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

shared_memory_portable_service

Path C:\ProgramData\RustDesk\shared_memory_portable_service
Size 22B
SHA256 464a0a59ccac905b6d9fcffd657f9bd68712d0a836f47661974259721b06233e
MD5 55f3606fdefd8ec5079e9df7f104b07f
SHA1 958c978d4335a648ab06ae40e5deef6994c10e0a
SHA512 26391b0fb20bf78fadcdf11ffce70986f1ccffaaa663f7130ab2de1b6241a65840b538a7195d091578399e0ab33dfc5ce268a726e1f346596b9343e1c69d6dc0
MD5 SHA1 SHA512

Submit Download

rustdesk.exe

Path C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
Size 18.1MB
SHA256 15c7f7197bc5ed8f3d4bd3253e5a23185df6f98e9e2f81944290714eb47229ba
MD5 6b50fc869ed4d5dd295d3d16b342f03a
SHA1 2c32af135809891e0171f54b9fa3d23af66aa0b7
SHA512 7ca6e9697cf1a4236597016ab08c23bfff18d9e6179725d1e4cb2884e6b745230194517cee5e239d0aae36c3769b7ac24a8d19a96710ef7bc7131744d46c6355
SSDEEP 393216:UqC9v7OQjqvpBQa2qCDfXjmaGwdYY/ltVOmsFoVt/FmehZYLKo2qVwf4vq81Z8S:LC9v7Ha25jmaGwdDlrOmsFoVt/FmehZk
TLSH
T19117AF41F78361B5D8860870116FB6BA57382D394328CAF7E7E47D35E4356E22A39F0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sciter.dll

Path C:\Users\Admin\AppData\Local\rustdesk\sciter.dll
Size 5.8MB
SHA256 285f3e6a051a7c61845cd7e4d2120781b6bdf411239f70a85c65b38a52d38f28
MD5 fc2311ca280c197f5ed16def6d464b6b
SHA1 0c0957c2db583a080010e63da9184a9ea1184b76
SHA512 8400ec74282f16caafcbcecf46cb289829ecaeeee400a5114c13751e83fb1bb660bb64a6961b612489bc764a711c40dcdecc4f835ce0dc4f1d602f2d67f75719
SSDEEP 98304:sKwCpE+mBoEBDeasdzH/cs8cfQW6OUiCpIWLQCIFBRQlt3RHffOYVvsIrqNkJW6t:sKL/ERqH/TQW6OKuWL6FERAIrqNp/8
TLSH
T19356AF23BB95803DC42F02B06E6EF37D81FABE7005B0412B2BB87E5D6EB09E15655563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads