Analysis
- max time kernel
151s - max time network
164s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
05/08/2026, 14:05
General
- Target 2026-08-05_76b53ee63368bae6e9f852d8cdfb317f_akira_amadey_elex_glassworm.exe
- Size 100.0MB
- Sample260805-rd8exstvdx
- SHA256 7e5edfb2356a1e233f4e8a062c9a64eb3c40bfd2be4778f6517236dcd2519e09
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_76b53ee63368bae6e9f852d8cdfb317f_akira_amadey_elex_glassworm.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-05_76b53ee63368bae6e9f852d8cdfb317f_akira_amadey_elex_glassworm.exe"1⤵
-
C:\ProgramData\AppRepository\0a2c0f09\ZillberRelayHost.exeC:\ProgramData\AppRepository\0a2c0f09\ZillberRelayHost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4424-9-0x0000000073552000-0x0000000073553000-memory.dmp
memory/4424-10-0x0000000004200000-0x000000000426E000-memory.dmp
memory/4424-11-0x0000000073540000-0x0000000073CFC000-memory.dmp
memory/4424-12-0x0000000073540000-0x0000000073CFC000-memory.dmp
memory/4424-13-0x0000000073540000-0x0000000073CFC000-memory.dmp
memory/4424-14-0x0000000004050000-0x000000000406A000-memory.dmp
memory/4424-15-0x0000000004080000-0x00000000040AC000-memory.dmp
memory/4424-19-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-27-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-51-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-85-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-109-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-141-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-139-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-137-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-135-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-133-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-131-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-129-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-127-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-125-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-123-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-121-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-119-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-117-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-115-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-113-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-111-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-107-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-105-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-103-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-101-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-99-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-97-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-95-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-93-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-91-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-89-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-87-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-83-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-81-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-79-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-77-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-75-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-73-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-71-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-69-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-67-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-65-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-63-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-61-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-59-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-57-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-55-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-53-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-49-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-47-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-45-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-43-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-41-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-39-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-37-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-35-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-33-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-31-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-29-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-26-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-21-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-17-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-23-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-16-0x0000000004080000-0x00000000040A6000-memory.dmp
memory/4424-642-0x0000000006980000-0x00000000069E6000-memory.dmp
memory/4424-643-0x0000000073552000-0x0000000073553000-memory.dmp
memory/4424-644-0x0000000073540000-0x0000000073CFC000-memory.dmp
memory/4424-645-0x0000000073540000-0x0000000073CFC000-memory.dmp
memory/4424-646-0x0000000073540000-0x0000000073CFC000-memory.dmp
memory/4424-649-0x0000000007180000-0x0000000007212000-memory.dmp
memory/4424-650-0x00000000077E0000-0x0000000007D9A000-memory.dmp
memory/4424-651-0x0000000007360000-0x00000000073E4000-memory.dmp
memory/4424-2904-0x0000000007530000-0x000000000753A000-memory.dmp