a14f8f296dfcea7ced291030fc91724e2c94e3cdf7ec7cefe7a5d358cdf08cfc

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 04:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_436fc1906db2d54f953e5b38385bfa54_akira_glassworm_icedid_rusty-stealer.exe
Size 3.1MB
Sample260805-eppezaxgre
SHA256 a14f8f296dfcea7ced291030fc91724e2c94e3cdf7ec7cefe7a5d358cdf08cfc
MD5 436fc1906db2d54f953e5b38385bfa54
SHA1 7f40d98331aa68e330a0476787a33b9ba906de01
SHA512 a9d0bb7b4d557306bc1026dcb82f1be2dd8cb04d6d5ebe0c80d4311c78a1fd6514331e39431b09199d53913b9b5f43995162a395d5ffb6b29f237a51fa570311
SSDEEP 49152:m89o4a37EzB4/eEX8qLersKMdeZZ6jwoUIRrUpOjFw637KrhxoY4IU6iton:pRz+2EXcrTl6WyIH+
TLSH
T144E54B02BA9B94ECC15AC475C3464A736E2174CB1B26B9FF42D496383F6ABE05B3C714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4072	SgrmBrokerSvc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemProtectionAgent = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SystemProtection\\SgrmBrokerSvc.exe"	2026-08-05_436fc1906db2d54f953e5b38385bfa54_akira_glassworm_icedid_rusty-stealer.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	2026-08-05_436fc1906db2d54f953e5b38385bfa54_akira_glassworm_icedid_rusty-stealer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2796	OpenWith.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-05_436fc1906db2d54f953e5b38385bfa54_akira_glassworm_icedid_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_436fc1906db2d54f953e5b38385bfa54_akira_glassworm_icedid_rusty-stealer.exe"
1⤵
- Adds Run key to start application
- Modifies registry class
PID:3900

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2796

C:\Users\Admin\AppData\Roaming\Microsoft\SystemProtection\SgrmBrokerSvc.exe
C:\Users\Admin\AppData\Roaming\Microsoft\SystemProtection\SgrmBrokerSvc.exe
1⤵
- Executes dropped EXE
PID:4072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sgrmbroker.log

Path C:\Users\Admin\AppData\Local\Temp\sgrmbroker.log
Size 56B
SHA256 3d950a2cdad7f658fcdec6e9a7e9da5a3855fdd75870c4df65305eb19f5c853e
MD5 4b54c2ebf1e89f66431112d7c7f37696
SHA1 1cd181deff4d7c3274f22dd66f329bdb007e26c8
SHA512 544ea8a2d9e7962ad360f3e6512c45adae1033e608905c5efe65cc14e844c75244d2b430da68a37e316399513de960cd46d136fc4e7a40fcabdf0749c5645b07
MD5 SHA1 SHA512

Submit Download

sgrmbroker.log

Path C:\Users\Admin\AppData\Local\Temp\sgrmbroker.log
Size 106B
SHA256 a41563d0c5895f1215ae3d4376c5d2ec54863181b1d284c3cd6ad47932055191
MD5 188df552342a087d24a6ec39656088f6
SHA1 f6a91066f4f160f7b33bbfd1b05d7e2f40b0092d
SHA512 b690c762114ecc7603e86cde2e536190efc1d2d488d88bdfa89d241ac6d08f7fcbc7cdfce5c8007d539f07476340cddcfc3d28f5c789b33a3460c8fa67f7a254
TLSH
T18DB001BC9CD9154D0D215468D3395820D6017E3316FB6DD6E9D64E8DA8980D9C42BB92
MD5 SHA1 SHA512 TLSH

Submit Download

SgrmBrokerSvc.cfg

Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemProtection\SgrmBrokerSvc.cfg
Size 15B
SHA256 ee47ef8dbe1b144b86007c4782010711016034603292a94c4642d51776094966
MD5 501473d2d4d376f219e614b9b7b97439
SHA1 d638fe159356205eab15b12908c2bf7df06ecd7c
SHA512 27ecac7959d270279355d326123f5dc7436bff5f9d6318618aff3e684007e93f4ebd0c18668c392a2248de4e36cc9993a5fe7f9b100d98f87610b35cb2f77f8b
MD5 SHA1 SHA512

Submit Download

SgrmBrokerSvc.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemProtection\SgrmBrokerSvc.exe
Size 3.1MB
SHA256 a14f8f296dfcea7ced291030fc91724e2c94e3cdf7ec7cefe7a5d358cdf08cfc
MD5 436fc1906db2d54f953e5b38385bfa54
SHA1 7f40d98331aa68e330a0476787a33b9ba906de01
SHA512 a9d0bb7b4d557306bc1026dcb82f1be2dd8cb04d6d5ebe0c80d4311c78a1fd6514331e39431b09199d53913b9b5f43995162a395d5ffb6b29f237a51fa570311
SSDEEP 49152:m89o4a37EzB4/eEX8qLersKMdeZZ6jwoUIRrUpOjFw637KrhxoY4IU6iton:pRz+2EXcrTl6WyIH+
TLSH
T144E54B02BA9B94ECC15AC475C3464A736E2174CB1B26B9FF42D496383F6ABE05B3C714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads