Analysis
- max time kernel
150s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
02/08/2026, 13:29
General
- Target 2026-08-02_e49accd9327466e2b13d2493bc810166_akira_glassworm_icedid_rusty-stealer.exe
- Size 21.6MB
- Sample260802-qrakdatelf
- SHA256 9e39da227fdd82c177a86c85f64a09e1b9231cd7a068ee48ae67596ef5b9332b
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 5 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: MapViewOfSection 4 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_e49accd9327466e2b13d2493bc810166_akira_glassworm_icedid_rusty-stealer.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_e49accd9327466e2b13d2493bc810166_akira_glassworm_icedid_rusty-stealer.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\PhotoOrganizer\PhotoOrganizer.exe"C:\ProgramData\PhotoOrganizer\PhotoOrganizer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k AssignedAccessManagerSvc -s AssignedAccessManagerSvc1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Cache.pmt
PhotoOrganizer.exe
obtoJB32.dll
memory/1716-118-0x0000000010000000-0x000000001036B000-memory.dmp
memory/1716-104-0x0000000010000000-0x000000001036B000-memory.dmp
memory/1716-107-0x0000000010000000-0x000000001036B000-memory.dmp
memory/1716-109-0x0000000010000000-0x000000001036B000-memory.dmp
memory/1716-110-0x0000000010000000-0x000000001036B000-memory.dmp
memory/1716-108-0x0000000010000000-0x000000001036B000-memory.dmp
memory/1716-119-0x0000000010000000-0x000000001036B000-memory.dmp
memory/1716-121-0x0000000010000000-0x000000001036B000-memory.dmp
memory/1716-122-0x0000000010000000-0x000000001036B000-memory.dmp
memory/1716-123-0x0000000010000000-0x000000001036B000-memory.dmp
memory/1716-120-0x0000000010000000-0x000000001036B000-memory.dmp
memory/1716-111-0x0000000010000000-0x000000001036B000-memory.dmp
memory/1716-112-0x0000000010000000-0x000000001036B000-memory.dmp
memory/3248-86-0x0000000010000000-0x000000001036B000-memory.dmp
memory/3248-87-0x0000000010000000-0x000000001036B000-memory.dmp
memory/3248-41-0x0000000001000000-0x0000000001364000-memory.dmp
memory/3248-42-0x0000000010000000-0x000000001036B000-memory.dmp
memory/3248-92-0x0000000010000000-0x000000001036B000-memory.dmp
memory/3248-69-0x0000000010000000-0x000000001036B000-memory.dmp
memory/3248-70-0x0000000010000000-0x000000001036B000-memory.dmp
memory/3248-76-0x0000000010000000-0x000000001036B000-memory.dmp
memory/3248-68-0x0000000010000000-0x000000001036B000-memory.dmp
memory/3248-67-0x0000000010000000-0x000000001036B000-memory.dmp
memory/3248-66-0x0000000010000000-0x000000001036B000-memory.dmp
memory/3248-62-0x0000000010000000-0x000000001036B000-memory.dmp
memory/3248-65-0x0000000010000000-0x000000001036B000-memory.dmp
memory/3248-88-0x0000000010000000-0x000000001036B000-memory.dmp
memory/3248-89-0x0000000010000000-0x000000001036B000-memory.dmp
memory/3248-90-0x0000000010000000-0x000000001036B000-memory.dmp
memory/3248-91-0x0000000010000000-0x000000001036B000-memory.dmp
memory/3452-35-0x0000000180000000-0x00000001803D1000-memory.dmp
memory/3452-26-0x000001FDA0CC0000-0x000001FDA108D000-memory.dmp
memory/3452-84-0x0000000180000000-0x00000001803D1000-memory.dmp
memory/3452-27-0x0000000180000000-0x00000001803D1000-memory.dmp
memory/3452-40-0x0000000180000000-0x00000001803D1000-memory.dmp
memory/3452-36-0x0000000180000000-0x00000001803D1000-memory.dmp
memory/3452-38-0x0000000180000000-0x00000001803D1000-memory.dmp
memory/3452-39-0x0000000180000000-0x00000001803D1000-memory.dmp
memory/3452-37-0x0000000180000000-0x00000001803D1000-memory.dmp
memory/4500-81-0x0000000180000000-0x00000001800B8000-memory.dmp
memory/4500-78-0x0000000180000000-0x00000001800B8000-memory.dmp
memory/4500-82-0x0000000180000000-0x00000001800B8000-memory.dmp
memory/4500-83-0x0000000180000000-0x00000001800B8000-memory.dmp
memory/4500-79-0x0000000180000000-0x00000001800B8000-memory.dmp
memory/4500-80-0x0000000180000000-0x00000001800B8000-memory.dmp
memory/4500-52-0x0000000180000000-0x00000001800B8000-memory.dmp
memory/4740-85-0x0000000180000000-0x00000001809F8000-memory.dmp
memory/4740-25-0x0000000180000000-0x00000001809F8000-memory.dmp
memory/4740-24-0x0000000180000000-0x00000001809F8000-memory.dmp
memory/4740-23-0x0000000180000000-0x00000001809F8000-memory.dmp
memory/4740-22-0x0000000180000000-0x00000001809F8000-memory.dmp
memory/4740-21-0x0000000180000000-0x00000001809F8000-memory.dmp
memory/4740-20-0x0000000180000000-0x00000001809F8000-memory.dmp
memory/4740-12-0x0000000180000000-0x00000001809F8000-memory.dmp