Analysis
- max time kernel
149s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 05:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_ab150d5b91f6805564085f351128d3ff_akira_elex_glassworm.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_ab150d5b91f6805564085f351128d3ff_akira_elex_glassworm.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
21 signatures
150 seconds
General
- Target 2026-08-10_ab150d5b91f6805564085f351128d3ff_akira_elex_glassworm.exe
- Size 18.4MB
- Sample260810-gpg21asdlb
- SHA256 5fc42055abcf7b45afd327d61a2f20adeda73745fc49300b0864cdb002117d76
- MD5 ab150d5b91f6805564085f351128d3ff
- SHA1 e05e4e6d1a62a173de9ee0d0c5c19694fcfd6497
- SHA512 3b251eb58e5b89e6745b4bb31ef104042f6c08d5bb99016f36d4d0533c0aa8d169f313b23e4ac4f7dcb791330f087d84bf5e484b76e101fa9da7ba7c028cb9e4
- SSDEEP 98304:dN8ltQgvfPz73JJTaxzPMNbq6n/bye+nQq7mQ01p1UfoUPx3:duTvf7754L2btbv+nQPz1PUPx
- TLSH T11817C0BC76047DE6666F577BDA96ACDC03B626239ACBA4CC8064B7C30563375FE02805
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 25 IoCs
resource yara_rule behavioral2/memory/6032-70-0x000000000A160000-0x000000000ADB6000-memory.dmp family_salatstealer behavioral2/memory/6032-71-0x000000000A160000-0x000000000ADB6000-memory.dmp family_salatstealer behavioral2/memory/6032-72-0x000000000A160000-0x000000000ADB6000-memory.dmp family_salatstealer behavioral2/memory/6032-75-0x000000000A160000-0x000000000ADB6000-memory.dmp family_salatstealer behavioral2/memory/6032-73-0x000000000A160000-0x000000000ADB6000-memory.dmp family_salatstealer behavioral2/memory/6032-76-0x000000000A160000-0x000000000ADB6000-memory.dmp family_salatstealer behavioral2/memory/6032-78-0x000000000A160000-0x000000000ADB6000-memory.dmp family_salatstealer behavioral2/memory/6032-80-0x000000000A160000-0x000000000ADB6000-memory.dmp family_salatstealer behavioral2/memory/6032-87-0x000000000A160000-0x000000000ADB6000-memory.dmp family_salatstealer behavioral2/memory/4340-166-0x000000000AD00000-0x000000000B956000-memory.dmp family_salatstealer behavioral2/memory/4340-165-0x000000000AD00000-0x000000000B956000-memory.dmp family_salatstealer behavioral2/memory/4340-168-0x000000000AD00000-0x000000000B956000-memory.dmp family_salatstealer behavioral2/memory/4340-169-0x000000000AD00000-0x000000000B956000-memory.dmp family_salatstealer behavioral2/memory/4340-167-0x000000000AD00000-0x000000000B956000-memory.dmp family_salatstealer behavioral2/memory/4340-171-0x000000000AD00000-0x000000000B956000-memory.dmp family_salatstealer behavioral2/memory/4340-176-0x000000000AD00000-0x000000000B956000-memory.dmp family_salatstealer behavioral2/memory/4340-177-0x000000000AD00000-0x000000000B956000-memory.dmp family_salatstealer behavioral2/memory/4340-178-0x000000000AD00000-0x000000000B956000-memory.dmp family_salatstealer behavioral2/memory/4340-181-0x000000000AD00000-0x000000000B956000-memory.dmp family_salatstealer behavioral2/memory/2920-284-0x000000000AA50000-0x000000000B6A6000-memory.dmp family_salatstealer behavioral2/memory/2920-286-0x000000000AA50000-0x000000000B6A6000-memory.dmp family_salatstealer behavioral2/memory/2920-285-0x000000000AA50000-0x000000000B6A6000-memory.dmp family_salatstealer behavioral2/memory/2920-287-0x000000000AA50000-0x000000000B6A6000-memory.dmp family_salatstealer behavioral2/memory/2920-288-0x000000000AA50000-0x000000000B6A6000-memory.dmp family_salatstealer behavioral2/memory/2920-289-0x000000000AA50000-0x000000000B6A6000-memory.dmp family_salatstealer - UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" powershell.exe - Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 25 IoCs
resource yara_rule behavioral2/memory/6032-70-0x000000000A160000-0x000000000ADB6000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/6032-71-0x000000000A160000-0x000000000ADB6000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/6032-72-0x000000000A160000-0x000000000ADB6000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/6032-75-0x000000000A160000-0x000000000ADB6000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/6032-73-0x000000000A160000-0x000000000ADB6000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/6032-76-0x000000000A160000-0x000000000ADB6000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/6032-78-0x000000000A160000-0x000000000ADB6000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/6032-80-0x000000000A160000-0x000000000ADB6000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/6032-87-0x000000000A160000-0x000000000ADB6000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/4340-166-0x000000000AD00000-0x000000000B956000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/4340-165-0x000000000AD00000-0x000000000B956000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/4340-168-0x000000000AD00000-0x000000000B956000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/4340-169-0x000000000AD00000-0x000000000B956000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/4340-167-0x000000000AD00000-0x000000000B956000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/4340-171-0x000000000AD00000-0x000000000B956000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/4340-176-0x000000000AD00000-0x000000000B956000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/4340-177-0x000000000AD00000-0x000000000B956000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/4340-178-0x000000000AD00000-0x000000000B956000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/4340-181-0x000000000AD00000-0x000000000B956000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/2920-284-0x000000000AA50000-0x000000000B6A6000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/2920-286-0x000000000AA50000-0x000000000B6A6000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/2920-285-0x000000000AA50000-0x000000000B6A6000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/2920-287-0x000000000AA50000-0x000000000B6A6000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/2920-288-0x000000000AA50000-0x000000000B6A6000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/2920-289-0x000000000AA50000-0x000000000B6A6000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs - Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 25 IoCs
resource yara_rule behavioral2/memory/6032-70-0x000000000A160000-0x000000000ADB6000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/6032-71-0x000000000A160000-0x000000000ADB6000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/6032-72-0x000000000A160000-0x000000000ADB6000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/6032-75-0x000000000A160000-0x000000000ADB6000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/6032-73-0x000000000A160000-0x000000000ADB6000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/6032-76-0x000000000A160000-0x000000000ADB6000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/6032-78-0x000000000A160000-0x000000000ADB6000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/6032-80-0x000000000A160000-0x000000000ADB6000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/6032-87-0x000000000A160000-0x000000000ADB6000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4340-166-0x000000000AD00000-0x000000000B956000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4340-165-0x000000000AD00000-0x000000000B956000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4340-168-0x000000000AD00000-0x000000000B956000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4340-169-0x000000000AD00000-0x000000000B956000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4340-167-0x000000000AD00000-0x000000000B956000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4340-171-0x000000000AD00000-0x000000000B956000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4340-176-0x000000000AD00000-0x000000000B956000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4340-177-0x000000000AD00000-0x000000000B956000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4340-178-0x000000000AD00000-0x000000000B956000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4340-181-0x000000000AD00000-0x000000000B956000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2920-284-0x000000000AA50000-0x000000000B6A6000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2920-286-0x000000000AA50000-0x000000000B6A6000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2920-285-0x000000000AA50000-0x000000000B6A6000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2920-287-0x000000000AA50000-0x000000000B6A6000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2920-288-0x000000000AA50000-0x000000000B6A6000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2920-289-0x000000000AA50000-0x000000000B6A6000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers - Detects executables containing SQL queries to confidential data stores. Observed in infostealers 25 IoCs
resource yara_rule behavioral2/memory/6032-70-0x000000000A160000-0x000000000ADB6000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/6032-71-0x000000000A160000-0x000000000ADB6000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/6032-72-0x000000000A160000-0x000000000ADB6000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/6032-75-0x000000000A160000-0x000000000ADB6000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/6032-73-0x000000000A160000-0x000000000ADB6000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/6032-76-0x000000000A160000-0x000000000ADB6000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/6032-78-0x000000000A160000-0x000000000ADB6000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/6032-80-0x000000000A160000-0x000000000ADB6000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/6032-87-0x000000000A160000-0x000000000ADB6000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/4340-166-0x000000000AD00000-0x000000000B956000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/4340-165-0x000000000AD00000-0x000000000B956000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/4340-168-0x000000000AD00000-0x000000000B956000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/4340-169-0x000000000AD00000-0x000000000B956000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/4340-167-0x000000000AD00000-0x000000000B956000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/4340-171-0x000000000AD00000-0x000000000B956000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/4340-176-0x000000000AD00000-0x000000000B956000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/4340-177-0x000000000AD00000-0x000000000B956000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/4340-178-0x000000000AD00000-0x000000000B956000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/4340-181-0x000000000AD00000-0x000000000B956000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/2920-284-0x000000000AA50000-0x000000000B6A6000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/2920-286-0x000000000AA50000-0x000000000B6A6000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/2920-285-0x000000000AA50000-0x000000000B6A6000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/2920-287-0x000000000AA50000-0x000000000B6A6000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/2920-288-0x000000000AA50000-0x000000000B6A6000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/2920-289-0x000000000AA50000-0x000000000B6A6000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore - UPX dump on OEP (original entry point) 29 IoCs
resource yara_rule behavioral2/memory/6032-65-0x000000000A160000-0x000000000ADB6000-memory.dmp UPX behavioral2/memory/6032-69-0x000000000A160000-0x000000000ADB6000-memory.dmp UPX behavioral2/memory/6032-70-0x000000000A160000-0x000000000ADB6000-memory.dmp UPX behavioral2/memory/6032-71-0x000000000A160000-0x000000000ADB6000-memory.dmp UPX behavioral2/memory/6032-72-0x000000000A160000-0x000000000ADB6000-memory.dmp UPX behavioral2/memory/6032-75-0x000000000A160000-0x000000000ADB6000-memory.dmp UPX behavioral2/memory/6032-73-0x000000000A160000-0x000000000ADB6000-memory.dmp UPX behavioral2/memory/6032-76-0x000000000A160000-0x000000000ADB6000-memory.dmp UPX behavioral2/memory/6032-78-0x000000000A160000-0x000000000ADB6000-memory.dmp UPX behavioral2/memory/6032-80-0x000000000A160000-0x000000000ADB6000-memory.dmp UPX behavioral2/memory/6032-87-0x000000000A160000-0x000000000ADB6000-memory.dmp UPX behavioral2/memory/4340-161-0x000000000AD00000-0x000000000B956000-memory.dmp UPX behavioral2/memory/4340-166-0x000000000AD00000-0x000000000B956000-memory.dmp UPX behavioral2/memory/4340-165-0x000000000AD00000-0x000000000B956000-memory.dmp UPX behavioral2/memory/4340-168-0x000000000AD00000-0x000000000B956000-memory.dmp UPX behavioral2/memory/4340-169-0x000000000AD00000-0x000000000B956000-memory.dmp UPX behavioral2/memory/4340-167-0x000000000AD00000-0x000000000B956000-memory.dmp UPX behavioral2/memory/4340-171-0x000000000AD00000-0x000000000B956000-memory.dmp UPX behavioral2/memory/4340-176-0x000000000AD00000-0x000000000B956000-memory.dmp UPX behavioral2/memory/4340-177-0x000000000AD00000-0x000000000B956000-memory.dmp UPX behavioral2/memory/4340-178-0x000000000AD00000-0x000000000B956000-memory.dmp UPX behavioral2/memory/4340-181-0x000000000AD00000-0x000000000B956000-memory.dmp UPX behavioral2/memory/2920-277-0x000000000AA50000-0x000000000B6A6000-memory.dmp UPX behavioral2/memory/2920-284-0x000000000AA50000-0x000000000B6A6000-memory.dmp UPX behavioral2/memory/2920-286-0x000000000AA50000-0x000000000B6A6000-memory.dmp UPX behavioral2/memory/2920-285-0x000000000AA50000-0x000000000B6A6000-memory.dmp UPX behavioral2/memory/2920-287-0x000000000AA50000-0x000000000B6A6000-memory.dmp UPX behavioral2/memory/2920-288-0x000000000AA50000-0x000000000B6A6000-memory.dmp UPX behavioral2/memory/2920-289-0x000000000AA50000-0x000000000B6A6000-memory.dmp UPX - Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 29 4824 powershell.exe 30 4824 powershell.exe 31 4824 powershell.exe 32 4824 powershell.exe 33 4824 powershell.exe - Executes dropped EXE 2 IoCs
pid Process 4340 lsass.exe 2920 lsass.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Recovery ReAgentc.exe File opened for modification C:\Windows\SysWOW64\Recovery\ReAgent.xml ReAgentc.exe -
resource yara_rule behavioral2/memory/6032-65-0x000000000A160000-0x000000000ADB6000-memory.dmp upx behavioral2/memory/6032-69-0x000000000A160000-0x000000000ADB6000-memory.dmp upx behavioral2/memory/6032-70-0x000000000A160000-0x000000000ADB6000-memory.dmp upx behavioral2/memory/6032-71-0x000000000A160000-0x000000000ADB6000-memory.dmp upx behavioral2/memory/6032-72-0x000000000A160000-0x000000000ADB6000-memory.dmp upx behavioral2/memory/6032-75-0x000000000A160000-0x000000000ADB6000-memory.dmp upx behavioral2/memory/6032-73-0x000000000A160000-0x000000000ADB6000-memory.dmp upx behavioral2/memory/6032-76-0x000000000A160000-0x000000000ADB6000-memory.dmp upx behavioral2/memory/6032-78-0x000000000A160000-0x000000000ADB6000-memory.dmp upx behavioral2/memory/6032-80-0x000000000A160000-0x000000000ADB6000-memory.dmp upx behavioral2/memory/6032-87-0x000000000A160000-0x000000000ADB6000-memory.dmp upx behavioral2/memory/4340-161-0x000000000AD00000-0x000000000B956000-memory.dmp upx behavioral2/memory/4340-166-0x000000000AD00000-0x000000000B956000-memory.dmp upx behavioral2/memory/4340-165-0x000000000AD00000-0x000000000B956000-memory.dmp upx behavioral2/memory/4340-168-0x000000000AD00000-0x000000000B956000-memory.dmp upx behavioral2/memory/4340-169-0x000000000AD00000-0x000000000B956000-memory.dmp upx behavioral2/memory/4340-167-0x000000000AD00000-0x000000000B956000-memory.dmp upx behavioral2/memory/4340-171-0x000000000AD00000-0x000000000B956000-memory.dmp upx behavioral2/memory/4340-176-0x000000000AD00000-0x000000000B956000-memory.dmp upx behavioral2/memory/4340-177-0x000000000AD00000-0x000000000B956000-memory.dmp upx behavioral2/memory/4340-178-0x000000000AD00000-0x000000000B956000-memory.dmp upx behavioral2/memory/4340-181-0x000000000AD00000-0x000000000B956000-memory.dmp upx behavioral2/memory/2920-277-0x000000000AA50000-0x000000000B6A6000-memory.dmp upx behavioral2/memory/2920-284-0x000000000AA50000-0x000000000B6A6000-memory.dmp upx behavioral2/memory/2920-286-0x000000000AA50000-0x000000000B6A6000-memory.dmp upx behavioral2/memory/2920-285-0x000000000AA50000-0x000000000B6A6000-memory.dmp upx behavioral2/memory/2920-287-0x000000000AA50000-0x000000000B6A6000-memory.dmp upx behavioral2/memory/2920-288-0x000000000AA50000-0x000000000B6A6000-memory.dmp upx behavioral2/memory/2920-289-0x000000000AA50000-0x000000000B6A6000-memory.dmp upx - Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft.NET\ee86fd4f-3220-47de-8649-4c64705e4f32 2026-08-10_ab150d5b91f6805564085f351128d3ff_akira_elex_glassworm.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\lsass.exe 2026-08-10_ab150d5b91f6805564085f351128d3ff_akira_elex_glassworm.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\lsass.exe lsass.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Panther\UnattendGC\diagwrn.xml ReAgentc.exe File opened for modification C:\Windows\Logs\ReAgent\ReAgent.log ReAgentc.exe File opened for modification C:\Windows\Panther\UnattendGC\setuperr.log ReAgentc.exe File opened for modification C:\Windows\Panther\UnattendGC\diagerr.xml ReAgentc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ReAgentc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_ab150d5b91f6805564085f351128d3ff_akira_elex_glassworm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe - Suspicious behavior: EnumeratesProcesses 44 IoCs
pid Process 6032 2026-08-10_ab150d5b91f6805564085f351128d3ff_akira_elex_glassworm.exe 6032 2026-08-10_ab150d5b91f6805564085f351128d3ff_akira_elex_glassworm.exe 6032 2026-08-10_ab150d5b91f6805564085f351128d3ff_akira_elex_glassworm.exe 6032 2026-08-10_ab150d5b91f6805564085f351128d3ff_akira_elex_glassworm.exe 4340 lsass.exe 4340 lsass.exe 4340 lsass.exe 4340 lsass.exe 4824 powershell.exe 4824 powershell.exe 4340 lsass.exe 4340 lsass.exe 4340 lsass.exe 4340 lsass.exe 4340 lsass.exe 4340 lsass.exe 4340 lsass.exe 4340 lsass.exe 4340 lsass.exe 4340 lsass.exe 4340 lsass.exe 4340 lsass.exe 4340 lsass.exe 4340 lsass.exe 4340 lsass.exe 4340 lsass.exe 4340 lsass.exe 4340 lsass.exe 4340 lsass.exe 4340 lsass.exe 4340 lsass.exe 4340 lsass.exe 4340 lsass.exe 4340 lsass.exe 4340 lsass.exe 4340 lsass.exe 4340 lsass.exe 4340 lsass.exe 4340 lsass.exe 4340 lsass.exe 4340 lsass.exe 4340 lsass.exe 4340 lsass.exe 4340 lsass.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4824 powershell.exe Token: SeIncreaseQuotaPrivilege 4824 powershell.exe Token: SeSecurityPrivilege 4824 powershell.exe Token: SeTakeOwnershipPrivilege 4824 powershell.exe Token: SeLoadDriverPrivilege 4824 powershell.exe Token: SeSystemProfilePrivilege 4824 powershell.exe Token: SeSystemtimePrivilege 4824 powershell.exe Token: SeProfSingleProcessPrivilege 4824 powershell.exe Token: SeIncBasePriorityPrivilege 4824 powershell.exe Token: SeCreatePagefilePrivilege 4824 powershell.exe Token: SeBackupPrivilege 4824 powershell.exe Token: SeRestorePrivilege 4824 powershell.exe Token: SeShutdownPrivilege 4824 powershell.exe Token: SeDebugPrivilege 4824 powershell.exe Token: SeSystemEnvironmentPrivilege 4824 powershell.exe Token: SeRemoteShutdownPrivilege 4824 powershell.exe Token: SeUndockPrivilege 4824 powershell.exe Token: SeManageVolumePrivilege 4824 powershell.exe Token: 33 4824 powershell.exe Token: 34 4824 powershell.exe Token: 35 4824 powershell.exe Token: 36 4824 powershell.exe Token: SeIncreaseQuotaPrivilege 4824 powershell.exe Token: SeSecurityPrivilege 4824 powershell.exe Token: SeTakeOwnershipPrivilege 4824 powershell.exe Token: SeLoadDriverPrivilege 4824 powershell.exe Token: SeSystemProfilePrivilege 4824 powershell.exe Token: SeSystemtimePrivilege 4824 powershell.exe Token: SeProfSingleProcessPrivilege 4824 powershell.exe Token: SeIncBasePriorityPrivilege 4824 powershell.exe Token: SeCreatePagefilePrivilege 4824 powershell.exe Token: SeBackupPrivilege 4824 powershell.exe Token: SeRestorePrivilege 4824 powershell.exe Token: SeShutdownPrivilege 4824 powershell.exe Token: SeDebugPrivilege 4824 powershell.exe Token: SeSystemEnvironmentPrivilege 4824 powershell.exe Token: SeRemoteShutdownPrivilege 4824 powershell.exe Token: SeUndockPrivilege 4824 powershell.exe Token: SeManageVolumePrivilege 4824 powershell.exe Token: 33 4824 powershell.exe Token: 34 4824 powershell.exe Token: 35 4824 powershell.exe Token: 36 4824 powershell.exe Token: SeIncreaseQuotaPrivilege 4824 powershell.exe Token: SeSecurityPrivilege 4824 powershell.exe Token: SeTakeOwnershipPrivilege 4824 powershell.exe Token: SeLoadDriverPrivilege 4824 powershell.exe Token: SeSystemProfilePrivilege 4824 powershell.exe Token: SeSystemtimePrivilege 4824 powershell.exe Token: SeProfSingleProcessPrivilege 4824 powershell.exe Token: SeIncBasePriorityPrivilege 4824 powershell.exe Token: SeCreatePagefilePrivilege 4824 powershell.exe Token: SeBackupPrivilege 4824 powershell.exe Token: SeRestorePrivilege 4824 powershell.exe Token: SeShutdownPrivilege 4824 powershell.exe Token: SeDebugPrivilege 4824 powershell.exe Token: SeSystemEnvironmentPrivilege 4824 powershell.exe Token: SeRemoteShutdownPrivilege 4824 powershell.exe Token: SeUndockPrivilege 4824 powershell.exe Token: SeManageVolumePrivilege 4824 powershell.exe Token: 33 4824 powershell.exe Token: 34 4824 powershell.exe Token: 35 4824 powershell.exe Token: 36 4824 powershell.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 6032 wrote to memory of 4340 6032 2026-08-10_ab150d5b91f6805564085f351128d3ff_akira_elex_glassworm.exe 90 PID 4340 wrote to memory of 4824 4340 lsass.exe 92 PID 4340 wrote to memory of 2920 4340 lsass.exe 94 PID 4824 wrote to memory of 3044 4824 powershell.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_ab150d5b91f6805564085f351128d3ff_akira_elex_glassworm.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_ab150d5b91f6805564085f351128d3ff_akira_elex_glassworm.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\Program Files (x86)\Microsoft.NET\lsass.exe"C:\Program Files (x86)\Microsoft.NET\lsass.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe3⤵
- UAC bypass
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\SysWOW64\ReAgentc.exe"C:\Windows\system32\ReAgentc.exe" /disable4⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3044
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\lsass.exe"C:\Program Files (x86)\Microsoft\Edge\Application\lsass.exe" -3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2920
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC1⤵PID:3344
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:4828
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft.NET\lsass.exe
- Size 18.4MB
- SHA256 5fc42055abcf7b45afd327d61a2f20adeda73745fc49300b0864cdb002117d76
- MD5 ab150d5b91f6805564085f351128d3ff
- SHA1 e05e4e6d1a62a173de9ee0d0c5c19694fcfd6497
- SHA512 3b251eb58e5b89e6745b4bb31ef104042f6c08d5bb99016f36d4d0533c0aa8d169f313b23e4ac4f7dcb791330f087d84bf5e484b76e101fa9da7ba7c028cb9e4
- SSDEEP 98304:dN8ltQgvfPz73JJTaxzPMNbq6n/bye+nQq7mQ01p1UfoUPx3:duTvf7754L2btbv+nQPz1PUPx
- TLSH T11817C0BC76047DE6666F577BDA96ACDC03B626239ACBA4CC8064B7C30563375FE02805
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\loader.exe
- Size 3.6MB
- SHA256 43497c1b45d9c6fed769895f8ffca80dcf2f02177e6ff4836bb76cb0244a72f0
- MD5 b306f79773970bed18ebeabe1bb89b5a
- SHA1 875c3889e2abc838c2f752d792606079c5dece97
- SHA512 865645913f7a0dff3d7f775d7d5e70ac72cbe12f8bd784f71b37c6635761ca1913caec31bf64f0b25f1c8b8ebee34f4222a2271398bb45f85677262764b2b17b
- SSDEEP 98304:hbLxlAmsxB4UZUCQqgDGrqKuhfriTBK3m+z18:9LxlAmsf4UIRqrDuhf+T1
- TLSH T17C0633F055ACEA40F465882FBF3F5C9AB4F8F91DDFA9AB1D13016B215918EC18B1884D
- MD5 SHA1 SHA512 SSDEEP TLSH