Analysis
- max time kernel
146s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
08/08/2026, 10:03
General
- Target 2026-08-08_40ac3aa1679ff6a18267997c84c2c1e2_akira_glassworm_icedid_rusty-stealer.exe
- Size 20.1MB
- Sample260808-l3k32avbmf
- SHA256 604e9593c994c0aa46cfed58cf818c902e7f8c03eaad1bdafefbc21ebd489536
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 5 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: MapViewOfSection 3 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_40ac3aa1679ff6a18267997c84c2c1e2_akira_glassworm_icedid_rusty-stealer.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_40ac3aa1679ff6a18267997c84c2c1e2_akira_glassworm_icedid_rusty-stealer.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\InputMethodHelper\InputMethodHelper.exe"C:\ProgramData\InputMethodHelper\InputMethodHelper.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k AssignedAccessManagerSvc -s AssignedAccessManagerSvc1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Cache.pmt
InputMethodHelper.exe
YRIYSj32.dll
memory/896-91-0x0000000003710000-0x000000000374E000-memory.dmp
memory/896-100-0x0000000003710000-0x000000000374E000-memory.dmp
memory/896-102-0x0000000003710000-0x000000000374E000-memory.dmp
memory/896-109-0x0000000003710000-0x000000000374E000-memory.dmp
memory/896-103-0x0000000003710000-0x000000000374E000-memory.dmp
memory/896-105-0x0000000003710000-0x000000000374E000-memory.dmp
memory/896-106-0x0000000003710000-0x000000000374E000-memory.dmp
memory/896-107-0x0000000003710000-0x000000000374E000-memory.dmp
memory/896-108-0x0000000003710000-0x000000000374E000-memory.dmp
memory/896-110-0x0000000003710000-0x000000000374E000-memory.dmp
memory/896-71-0x0000000010000000-0x0000000010281000-memory.dmp
memory/896-101-0x0000000003710000-0x000000000374E000-memory.dmp
memory/896-90-0x0000000010000000-0x0000000010281000-memory.dmp
memory/896-96-0x0000000003710000-0x000000000374E000-memory.dmp
memory/896-97-0x0000000003710000-0x000000000374E000-memory.dmp
memory/896-49-0x0000000010000000-0x0000000010281000-memory.dmp
memory/896-61-0x0000000010000000-0x0000000010281000-memory.dmp
memory/896-62-0x0000000010000000-0x0000000010281000-memory.dmp
memory/896-64-0x0000000010000000-0x0000000010281000-memory.dmp
memory/896-66-0x0000000010000000-0x0000000010281000-memory.dmp
memory/896-63-0x0000000010000000-0x0000000010281000-memory.dmp
memory/896-99-0x0000000003710000-0x000000000374E000-memory.dmp
memory/896-58-0x0000000010000000-0x0000000010281000-memory.dmp
memory/896-60-0x0000000010000000-0x0000000010281000-memory.dmp
memory/896-55-0x0000000001260000-0x00000000014DB000-memory.dmp
memory/896-70-0x0000000010000000-0x0000000010281000-memory.dmp
memory/896-98-0x0000000003710000-0x000000000374E000-memory.dmp
memory/896-104-0x0000000003710000-0x000000000374E000-memory.dmp
memory/896-59-0x0000000010000000-0x0000000010281000-memory.dmp
memory/4720-46-0x0000000180000000-0x00000001803D6000-memory.dmp
memory/4720-111-0x0000000180000000-0x00000001803D6000-memory.dmp
memory/4720-44-0x0000000180000000-0x00000001803D6000-memory.dmp
memory/4720-42-0x0000000180000000-0x00000001803D6000-memory.dmp
memory/4720-33-0x0000025E9B530000-0x0000025E9B902000-memory.dmp
memory/4720-34-0x0000000180000000-0x00000001803D6000-memory.dmp
memory/4720-45-0x0000000180000000-0x00000001803D6000-memory.dmp
memory/4720-47-0x0000000180000000-0x00000001803D6000-memory.dmp
memory/4720-43-0x0000000180000000-0x00000001803D6000-memory.dmp
memory/5220-74-0x0000000180000000-0x00000001800BA000-memory.dmp
memory/5220-86-0x0000000180000000-0x00000001800BA000-memory.dmp
memory/5220-89-0x0000000180000000-0x00000001800BA000-memory.dmp
memory/5220-88-0x0000000180000000-0x00000001800BA000-memory.dmp
memory/5220-85-0x0000000180000000-0x00000001800BA000-memory.dmp
memory/5220-87-0x0000000180000000-0x00000001800BA000-memory.dmp
memory/5220-83-0x0000000180000000-0x00000001800BA000-memory.dmp
memory/5408-32-0x0000000180000000-0x0000000180926000-memory.dmp
memory/5408-31-0x0000000180000000-0x0000000180926000-memory.dmp
memory/5408-19-0x0000000180000000-0x0000000180926000-memory.dmp
memory/5408-30-0x0000000180000000-0x0000000180926000-memory.dmp
memory/5408-27-0x0000000180000000-0x0000000180926000-memory.dmp
memory/5408-28-0x0000000180000000-0x0000000180926000-memory.dmp
memory/5408-29-0x0000000180000000-0x0000000180926000-memory.dmp
memory/5408-112-0x0000000180000000-0x0000000180926000-memory.dmp