28277f04f882928bc2eddaf29f9ecd0605a939e9952b53e5c629a5d9f2b1b43e

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 17:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_11a81cca991d5996d8a84f588416bfdf_akira_glassworm_rusty-stealer.exe
Size 870KB
Sample260809-vramlavzcv
SHA256 28277f04f882928bc2eddaf29f9ecd0605a939e9952b53e5c629a5d9f2b1b43e
MD5 11a81cca991d5996d8a84f588416bfdf
SHA1 56a8952483374ef006cb6cd4a1672bba5466fe06
SHA512 e9d7e748959b4c9aa0761fe3175d5b419960c6ce6ebb318a89ace98baffe2321a2865083225ad3f57bb2a40e8e10ced06650777a792d33dccc185b68f774c96d
SSDEEP 12288:wjDPb4JB7FrnmGcbqKlZWnZQnyB4FmE4CXQ+twdYFTvjrDHc5VE+XZJAfdLyE4:EgTpcWKlEqyB4FU+twaTXDKVNZJAF
TLSH
T1F215C01AAB4448F9D489C874C3479A635AB674CB1B36A5FF02D212243F7EAF51F2C319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution

Malware Config

Signatures

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip.sb

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2996	cmd.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
800	WINWORD.EXE
800	WINWORD.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
800	WINWORD.EXE
800	WINWORD.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
800	WINWORD.EXE
800	WINWORD.EXE
800	WINWORD.EXE
800	WINWORD.EXE
800	WINWORD.EXE
800	WINWORD.EXE
800	WINWORD.EXE
800	WINWORD.EXE
800	WINWORD.EXE
800	WINWORD.EXE
800	WINWORD.EXE
800	WINWORD.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 5008	3452	2026-08-09_11a81cca991d5996d8a84f588416bfdf_akira_glassworm_rusty-stealer.exe	89
PID 3452 wrote to memory of 2996	3452	2026-08-09_11a81cca991d5996d8a84f588416bfdf_akira_glassworm_rusty-stealer.exe	92
PID 2996 wrote to memory of 800	2996	cmd.exe	94

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	9	curl/8.8.0

C:\Users\Admin\AppData\Local\Temp\2026-08-09_11a81cca991d5996d8a84f588416bfdf_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_11a81cca991d5996d8a84f588416bfdf_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Windows\system32\curl.exe
  "curl" ip.sb
  2⤵
  PID:5008
- C:\Windows\system32\cmd.exe
  "cmd" /c start "" C:\Users\Admin\AppData\Local\Temp\sample_word_document.docx
  2⤵
  - Executes a command shell one-liner
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2996
- - C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\sample_word_document.docx" /o ""
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gb.xsl

Path C:\Users\Admin\AppData\Local\Temp\TCD6D58.tmp\gb.xsl
Size 262KB
SHA256 6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
MD5 51d32ee5bc7ab811041f799652d26e04
SHA1 412193006aa3ef19e0a57e16acf86b830993024a
SHA512 5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
SSDEEP 6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
TLSH
T19A4458A5E6D9CF144BB1F23FD8B52092EA1DC87B29341D41F1DC733717AE948822B662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sample_word_document.docx

Path C:\Users\Admin\AppData\Local\Temp\sample_word_document.docx
Size 36KB
SHA256 a59b53cebb440099a5715d0cc7d0b7d0d92909ca785232fb4d4ee7595fff5254
MD5 dcd56ed264c63facb50384c8a8a39d5c
SHA1 283c5d014375004cd453cacd44dc02f5aad3f74c
SHA512 cb4e6f5b27822ffd0e6d781ca92d951344fe28f9f09c796e7326a5cafcc38f063d99080c4c57a0e4977063c788b4216a30b1858317a8403c46276b3a3da4b8e6
SSDEEP 768:ti4Wnm7rdW8RhejzaCRWrY/CGD5uLiNTKUUjdvYTfoZ4yy:U/m7rZHI/r/CGD5uLmdUZwX
TLSH
T1C6F2F234CA276471E497FB72FD290D91F2E9997082C1376B3C3BC29590B3B4D6A27505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fb3b0dbfee58fac8.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Size 2KB
SHA256 70a50b6a0f5b10b52f4c4e12aa8132e84afb962550120279bbeb85bfd75ca321
MD5 c97ab299ac083a7fd7bacf002ad7ee4b
SHA1 57d4d14b747d7ee4a185d6ad152963dc11791702
SHA512 924c5025cdb086f3ca097a94cae7b5c3a5e1f982d9444cd4f31388a4f6f18b894b55c11915d09c589ad36252a3f9f57d0aa837d6f47bb6db1f069709b390aa8e
TLSH
T1E451100257AB9B5AD4E043F7162A4749FB30BE02F610679D9989242B6C70C908FADB5F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/800-10-0x00007FFE6BB40000-0x00007FFE6BB50000-memory.dmp

Download

memory/800-4-0x00007FFE6E6A0000-0x00007FFE6E6B0000-memory.dmp

Download

memory/800-7-0x00007FFE6E6A0000-0x00007FFE6E6B0000-memory.dmp

Download

memory/800-8-0x00007FFE6E6A0000-0x00007FFE6E6B0000-memory.dmp

Download

memory/800-9-0x00007FFE6BB40000-0x00007FFE6BB50000-memory.dmp

Download

memory/800-5-0x00007FFE6E6A0000-0x00007FFE6E6B0000-memory.dmp

Download

memory/800-6-0x00007FFE6E6A0000-0x00007FFE6E6B0000-memory.dmp

Download

memory/800-173-0x00007FFE6E6A0000-0x00007FFE6E6B0000-memory.dmp

Download

memory/800-174-0x00007FFE6E6A0000-0x00007FFE6E6B0000-memory.dmp

Download

memory/800-176-0x00007FFE6E6A0000-0x00007FFE6E6B0000-memory.dmp

Download

memory/800-175-0x00007FFE6E6A0000-0x00007FFE6E6B0000-memory.dmp

Download

memory/3452-2-0x0000015720400000-0x0000015720872000-memory.dmp

Download

memory/3452-112-0x00000157202D0000-0x00000157202D2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads