f1bf109df26e2431a133b514b451150e0f75827240534316e63875e3d3e066e9

Analysis

max time kernel
150s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 07:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-12_86117cd39b2294860591c06ec919863c_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
Size 10.3MB
Sample260812-h5j2za1elf
SHA256 f1bf109df26e2431a133b514b451150e0f75827240534316e63875e3d3e066e9
MD5 86117cd39b2294860591c06ec919863c
SHA1 97aa065c8a59bcae3d6610538d84c2c2e6cd71c8
SHA512 2f60aa883cc19b2a2c0f4f17e54e2f8e9a1626fcdd1829c18e6ee3680570149909af0afa50751b78f26a102e42037e2828ab24253ba34dcee9b0c788f09b1086
SSDEEP 49152:dXHt6biSIxlU4xm/ttQpECzyE9QYcuvSIRYgD/17J45tcNjHcD:tduDQCE9qBgDGtcNjcD
TLSH
T1A8B69E56A26401EDC1A7C574CA92975FC7F174020BF2AFAF22E09AA91F177E41E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5856	proxy_checker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 5856	2712	2026-08-12_86117cd39b2294860591c06ec919863c_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-12_86117cd39b2294860591c06ec919863c_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_86117cd39b2294860591c06ec919863c_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Users\Admin\AppData\Local\Temp\proxy_checker\proxy_checker.exe
  "C:\Users\Admin\AppData\Local\Temp\proxy_checker\proxy_checker.exe"
  2⤵
  - Executes dropped EXE
  PID:5856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

proxy_checker.exe

Path C:\Users\Admin\AppData\Local\Temp\proxy_checker\proxy_checker.exe
Size 111KB
SHA256 ee40855dda141b84da8396d38b7de75254a23c3a36bc7fd1d7204b56518054f8
MD5 53460b4083068ec3c2b391fcd40fe67b
SHA1 92670e87d37ee55411e83734cd02c87090ab17be
SHA512 38bf531827f7ea142929eb60d09d0dd09e22193db9495ba5568bf3fed9f973d8955a8b2ce6dc485aca9f532869686ac9bf350f4b3f6fc8a03f2d72a58c424bcb
SSDEEP 3072:baRaMf0Sab1Xx5/kd8Qafvk5bcXMTwkah4:JY0PJh5/kGQYVkf
TLSH
T12AB35C17A6A670FBE66A8978C9120D05DF72BCB14B90AF5F53540ED60F236908F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download