Analysis
- max time kernel
146s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
02/08/2026, 13:29
General
- Target 2026-08-02_e49accd9327466e2b13d2493bc810166_akira_glassworm_icedid_rusty-stealer.exe
- Size 21.6MB
- Sample260802-qrakdatelf
- SHA256 9e39da227fdd82c177a86c85f64a09e1b9231cd7a068ee48ae67596ef5b9332b
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 5 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: MapViewOfSection 3 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_e49accd9327466e2b13d2493bc810166_akira_glassworm_icedid_rusty-stealer.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_e49accd9327466e2b13d2493bc810166_akira_glassworm_icedid_rusty-stealer.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\UpdateService\UpdateService.exe"C:\ProgramData\UpdateService\UpdateService.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k AssignedAccessManagerSvc -s AssignedAccessManagerSvc1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Cache.pmt
UpdateService.exe
obtoJB32.dll
memory/1636-12-0x0000000180000000-0x00000001809F8000-memory.dmp
memory/1636-20-0x0000000180000000-0x00000001809F8000-memory.dmp
memory/1636-22-0x0000000180000000-0x00000001809F8000-memory.dmp
memory/1636-23-0x0000000180000000-0x00000001809F8000-memory.dmp
memory/1636-21-0x0000000180000000-0x00000001809F8000-memory.dmp
memory/1636-25-0x0000000180000000-0x00000001809F8000-memory.dmp
memory/1636-24-0x0000000180000000-0x00000001809F8000-memory.dmp
memory/1636-89-0x0000000180000000-0x00000001809F8000-memory.dmp
memory/2788-26-0x0000000180000000-0x00000001803D1000-memory.dmp
memory/2788-37-0x0000000180000000-0x00000001803D1000-memory.dmp
memory/2788-40-0x0000000180000000-0x00000001803D1000-memory.dmp
memory/2788-34-0x0000000180000000-0x00000001803D1000-memory.dmp
memory/2788-36-0x0000000180000000-0x00000001803D1000-memory.dmp
memory/2788-35-0x0000000180000000-0x00000001803D1000-memory.dmp
memory/2788-39-0x0000000180000000-0x00000001803D1000-memory.dmp
memory/2788-38-0x000002D7B7C70000-0x000002D7B803D000-memory.dmp
memory/2788-88-0x0000000180000000-0x00000001803D1000-memory.dmp
memory/4160-84-0x0000000010000000-0x000000001036B000-memory.dmp
memory/4160-73-0x0000000010000000-0x000000001036B000-memory.dmp
memory/4160-41-0x0000000000770000-0x0000000000AD4000-memory.dmp
memory/4160-87-0x0000000010000000-0x000000001036B000-memory.dmp
memory/4160-75-0x0000000010000000-0x000000001036B000-memory.dmp
memory/4160-77-0x0000000010000000-0x000000001036B000-memory.dmp
memory/4160-74-0x0000000010000000-0x000000001036B000-memory.dmp
memory/4160-51-0x0000000010000000-0x000000001036B000-memory.dmp
memory/4160-70-0x0000000010000000-0x000000001036B000-memory.dmp
memory/4160-78-0x0000000010000000-0x000000001036B000-memory.dmp
memory/4160-76-0x0000000010000000-0x000000001036B000-memory.dmp
memory/4276-69-0x0000000180000000-0x00000001800B8000-memory.dmp
memory/4276-62-0x0000020398890000-0x0000020398944000-memory.dmp
memory/4276-68-0x0000000180000000-0x00000001800B8000-memory.dmp
memory/4276-63-0x0000000180000000-0x00000001800B8000-memory.dmp
memory/4276-65-0x0000000180000000-0x00000001800B8000-memory.dmp
memory/4276-66-0x0000000180000000-0x00000001800B8000-memory.dmp
memory/4276-42-0x0000000180000000-0x00000001800B8000-memory.dmp
memory/4276-67-0x0000000180000000-0x00000001800B8000-memory.dmp