c234db0fdb2df8c74354abec44e8483b08d614adf1ca7442529957f7d8b5d893

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 17:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_647baced476b821bedfbe38e9ab05129_akira_glassworm_icedid_rusty-stealer.exe
Size 3.1MB
Sample260806-vrh9qswerf
SHA256 c234db0fdb2df8c74354abec44e8483b08d614adf1ca7442529957f7d8b5d893
MD5 647baced476b821bedfbe38e9ab05129
SHA1 f8f39092227b3faa6e6b4038bae288c436b162f1
SHA512 dff891a3a674c1e8c294a7d84ac3c46dccdebedb2a7bcd357c1d3729d659fa87ad2418e75bdeb373cb0d07b85a3d7ab34cb1ab67bfad8102304fbda20534019c
SSDEEP 49152:93GOdaPMg56JcNmRVuz/B5vgiqhyn7/GrUpOjFw6376fSh4IU6itoGl:O080cu07QWyPH+9l
TLSH
T1B8E54B02BA9B94ECC15AC474C3464A736E2174CB1B26B9FF46D496383F6ABE15B3C704
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5040	DesktopSessionSvc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\DesktopSessionMedic = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DesktopSession\\DesktopSessionSvc.exe"	2026-08-06_647baced476b821bedfbe38e9ab05129_akira_glassworm_icedid_rusty-stealer.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	2026-08-06_647baced476b821bedfbe38e9ab05129_akira_glassworm_icedid_rusty-stealer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4764	OpenWith.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-06_647baced476b821bedfbe38e9ab05129_akira_glassworm_icedid_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_647baced476b821bedfbe38e9ab05129_akira_glassworm_icedid_rusty-stealer.exe"
1⤵
- Adds Run key to start application
- Modifies registry class
PID:2420

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4764

C:\Users\Admin\AppData\Roaming\Microsoft\DesktopSession\DesktopSessionSvc.exe
C:\Users\Admin\AppData\Roaming\Microsoft\DesktopSession\DesktopSessionSvc.exe
1⤵
- Executes dropped EXE
PID:5040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktopsession.log

Path C:\Users\Admin\AppData\Local\Temp\desktopsession.log
Size 56B
SHA256 81e0d7fcca76c3a0d4d2656bd7ea8bbbf66e92d61cf2478add4e1a8e6fd9742e
MD5 a0b79abccf423a2ca37876590fa413ee
SHA1 0887c33d916d7e758ab4539eb5833c3b20cf46f7
SHA512 5fcb7eb26289e17ccfd737523a93ad672f5385bb28aaf7adcc9f7a4a4f401f354172a0fb76b2bb14c74fda2179fa0fd21eddb6c14c17960e05263ce6702cc5b2
MD5 SHA1 SHA512

Submit Download

desktopsession.log

Path C:\Users\Admin\AppData\Local\Temp\desktopsession.log
Size 4KB
SHA256 93a59ffee343b31037fb438599d617ac801b3a8e880c81aa1ce11e0bdbbbec6b
MD5 4897be87d5bcdfe4047d9b4c1def199b
SHA1 e5e59d308733dfd69a846fab93d89836f2141736
SHA512 557f4d3b21721010089b0d3ad7ae4ba35df2a6435ec6dd1604aea8cdfdb9a4a6fe7275a128d7c7d1ef8db61c86dbeefd6afee23100dfd2d5144724f245b295a9
SSDEEP 96:LKB0R0R0p0g0B0u0F0d040t0d0B0Z0Q0J0h010N0w0l0l0Z0x0F0Z0h0p0J04057:Lqqyl6neGN2G6C1SauWV++CKeCaySNie
TLSH
T11191FF37EB85707507A671B02B6EE1C9A63002B32BFD994363B901163297EE4D5B338D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktopsession.log

Path C:\Users\Admin\AppData\Local\Temp\desktopsession.log
Size 167B
SHA256 42e1281a7cfc29cb12143e0af1118e8f081ef76fb10c918e7dc334643b21bbfe
MD5 9402e0583c573ef5ae30dd4aa5a7c4c9
SHA1 5502f2704bd5a8445fbe896d41dd09430937ef25
SHA512 168769d2d3ad0b68566e5b72f6b19909ada070e804f34c08fc08b5d298d9ebb5342ea19f90ea7b524dd325595af8f95d74bceb14d8d7acdcecd4e3aa72a8fcb8
TLSH
T12AC08C32DF803078039230A02BB9D0AC932003A327FC6A4A2B740219B152990C07328C
MD5 SHA1 SHA512 TLSH

Submit Download

DesktopSessionSvc.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\DesktopSession\DesktopSessionSvc.exe
Size 3.1MB
SHA256 c234db0fdb2df8c74354abec44e8483b08d614adf1ca7442529957f7d8b5d893
MD5 647baced476b821bedfbe38e9ab05129
SHA1 f8f39092227b3faa6e6b4038bae288c436b162f1
SHA512 dff891a3a674c1e8c294a7d84ac3c46dccdebedb2a7bcd357c1d3729d659fa87ad2418e75bdeb373cb0d07b85a3d7ab34cb1ab67bfad8102304fbda20534019c
SSDEEP 49152:93GOdaPMg56JcNmRVuz/B5vgiqhyn7/GrUpOjFw6376fSh4IU6itoGl:O080cu07QWyPH+9l
TLSH
T1B8E54B02BA9B94ECC15AC474C3464A736E2174CB1B26B9FF46D496383F6ABE15B3C704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads