a14f8f296dfcea7ced291030fc91724e2c94e3cdf7ec7cefe7a5d358cdf08cfc

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 04:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_436fc1906db2d54f953e5b38385bfa54_akira_glassworm_icedid_rusty-stealer.exe
Size 3.1MB
Sample260805-eppezaxgre
SHA256 a14f8f296dfcea7ced291030fc91724e2c94e3cdf7ec7cefe7a5d358cdf08cfc
MD5 436fc1906db2d54f953e5b38385bfa54
SHA1 7f40d98331aa68e330a0476787a33b9ba906de01
SHA512 a9d0bb7b4d557306bc1026dcb82f1be2dd8cb04d6d5ebe0c80d4311c78a1fd6514331e39431b09199d53913b9b5f43995162a395d5ffb6b29f237a51fa570311
SSDEEP 49152:m89o4a37EzB4/eEX8qLersKMdeZZ6jwoUIRrUpOjFw637KrhxoY4IU6iton:pRz+2EXcrTl6WyIH+
TLSH
T144E54B02BA9B94ECC15AC475C3464A736E2174CB1B26B9FF42D496383F6ABE05B3C714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4464	SgrmBrokerSvc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemProtectionAgent = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SystemProtection\\SgrmBrokerSvc.exe"	2026-08-05_436fc1906db2d54f953e5b38385bfa54_akira_glassworm_icedid_rusty-stealer.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings	2026-08-05_436fc1906db2d54f953e5b38385bfa54_akira_glassworm_icedid_rusty-stealer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4340	OpenWith.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-05_436fc1906db2d54f953e5b38385bfa54_akira_glassworm_icedid_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_436fc1906db2d54f953e5b38385bfa54_akira_glassworm_icedid_rusty-stealer.exe"
1⤵
- Adds Run key to start application
- Modifies registry class
PID:5860

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4340

C:\Users\Admin\AppData\Roaming\Microsoft\SystemProtection\SgrmBrokerSvc.exe
C:\Users\Admin\AppData\Roaming\Microsoft\SystemProtection\SgrmBrokerSvc.exe
1⤵
- Executes dropped EXE
PID:4464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sgrmbroker.log

Path C:\Users\Admin\AppData\Local\Temp\sgrmbroker.log
Size 56B
SHA256 c7eae3815f0e0a996c7bfda27583a0d99de83c7eced7ba22b40e49c50b92fee2
MD5 3763d53048506752d1165b0b152d3ecf
SHA1 2fcf2180a8c966cdfb9ef417eed5d1b05b1b8adf
SHA512 50e8f05112e52b82ae685ed17683a2441128ac84c045c317e443f6bce1eb74832d629ec13df76c1128934f9654f100cb11e9de7ad72c2cdc9a05820d97cc8b2c
MD5 SHA1 SHA512

Submit Download

sgrmbroker.log

Path C:\Users\Admin\AppData\Local\Temp\sgrmbroker.log
Size 106B
SHA256 fbf4145f5475ac7a838bc877a00083bd7f03cf55da60d2b3cbdb6d41fce70341
MD5 023c3bef0a410b2fe1888fbbf2e0fb11
SHA1 6d97b43d3819a6fad5048b4c1730b3e5312aa87c
SHA512 6a1be7665c4b027145eb8faee9f9ddde61c2fe105e0c4ddc01acdf1760b0765cfd10a00de000948f74a7c3a147245167e3d2600f893fcaac159b78d72223f495
TLSH
T1A3B001BC9DC91A4E0E255464D7394830D501BEB316FE6CD2E4F48E8DA4A88E1A42BB92
MD5 SHA1 SHA512 TLSH

Submit Download

SgrmBrokerSvc.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemProtection\SgrmBrokerSvc.exe
Size 3.1MB
SHA256 a14f8f296dfcea7ced291030fc91724e2c94e3cdf7ec7cefe7a5d358cdf08cfc
MD5 436fc1906db2d54f953e5b38385bfa54
SHA1 7f40d98331aa68e330a0476787a33b9ba906de01
SHA512 a9d0bb7b4d557306bc1026dcb82f1be2dd8cb04d6d5ebe0c80d4311c78a1fd6514331e39431b09199d53913b9b5f43995162a395d5ffb6b29f237a51fa570311
SSDEEP 49152:m89o4a37EzB4/eEX8qLersKMdeZZ6jwoUIRrUpOjFw637KrhxoY4IU6iton:pRz+2EXcrTl6WyIH+
TLSH
T144E54B02BA9B94ECC15AC475C3464A736E2174CB1B26B9FF42D496383F6ABE05B3C714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads