Analysis
- max time kernel
148s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/08/2026, 17:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-12_6ad4c1353e79e1d4fa7dde09dc67e831_akira_amadey_elex_glassworm.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-12_6ad4c1353e79e1d4fa7dde09dc67e831_akira_amadey_elex_glassworm.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
General
- Target 2026-08-12_6ad4c1353e79e1d4fa7dde09dc67e831_akira_amadey_elex_glassworm.exe
- Size 4.2MB
- Sample260812-wdevtscl6z
- SHA256 8233cc8398dee13ac7548ad7aab92b0655b40dfc0af60142d79b7a9d09acab23
- MD5 6ad4c1353e79e1d4fa7dde09dc67e831
- SHA1 cb83d3be1b2644be0489d03d8d2f13f0157da2b3
- SHA512 c699c5b85b38db5266577b7d13d694904604aa9f4d5fbb75932501bfd372a51c4d9ef13a529a160231fc86b498ce60bf9abfd29514b127337c54aa7913c81652
- SSDEEP 49152:X/v8lFhT2YXQTAv7lkO5DdGntR2lYooZaZ8Bqe6XyGaRDkZNUuHtWKBwFosu7SjP:XX8lF/Xv5DgtR2lYooq8MpyVoNUGijC
- TLSH T1111602033BFEB06EEA6B97B494A463454625FC770D51C18A35CC149B0F9B6407EBC2BA
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 27 IoCs
resource yara_rule behavioral2/memory/7076-34-0x0000000003130000-0x0000000003D8C000-memory.dmp family_salatstealer behavioral2/memory/7076-35-0x0000000003130000-0x0000000003D8C000-memory.dmp family_salatstealer behavioral2/memory/7076-36-0x0000000003130000-0x0000000003D8C000-memory.dmp family_salatstealer behavioral2/memory/7076-39-0x0000000003130000-0x0000000003D8C000-memory.dmp family_salatstealer behavioral2/memory/7076-37-0x0000000003130000-0x0000000003D8C000-memory.dmp family_salatstealer behavioral2/memory/7076-40-0x0000000003130000-0x0000000003D8C000-memory.dmp family_salatstealer behavioral2/memory/7076-41-0x0000000003130000-0x0000000003D8C000-memory.dmp family_salatstealer behavioral2/memory/7076-42-0x0000000003130000-0x0000000003D8C000-memory.dmp family_salatstealer behavioral2/memory/7076-52-0x0000000003130000-0x0000000003D8C000-memory.dmp family_salatstealer behavioral2/memory/3332-90-0x0000000003E50000-0x0000000004AAC000-memory.dmp family_salatstealer behavioral2/memory/3332-91-0x0000000003E50000-0x0000000004AAC000-memory.dmp family_salatstealer behavioral2/memory/3332-93-0x0000000003E50000-0x0000000004AAC000-memory.dmp family_salatstealer behavioral2/memory/3332-92-0x0000000003E50000-0x0000000004AAC000-memory.dmp family_salatstealer behavioral2/memory/3332-95-0x0000000003E50000-0x0000000004AAC000-memory.dmp family_salatstealer behavioral2/memory/3332-94-0x0000000003E50000-0x0000000004AAC000-memory.dmp family_salatstealer behavioral2/memory/3332-96-0x0000000003E50000-0x0000000004AAC000-memory.dmp family_salatstealer behavioral2/memory/3332-97-0x0000000003E50000-0x0000000004AAC000-memory.dmp family_salatstealer behavioral2/memory/3332-98-0x0000000003E50000-0x0000000004AAC000-memory.dmp family_salatstealer behavioral2/memory/3332-99-0x0000000003E50000-0x0000000004AAC000-memory.dmp family_salatstealer behavioral2/memory/3332-111-0x0000000003E50000-0x0000000004AAC000-memory.dmp family_salatstealer behavioral2/memory/3332-142-0x0000000003E50000-0x0000000004AAC000-memory.dmp family_salatstealer behavioral2/memory/6664-162-0x0000000004B10000-0x000000000576C000-memory.dmp family_salatstealer behavioral2/memory/6664-164-0x0000000004B10000-0x000000000576C000-memory.dmp family_salatstealer behavioral2/memory/6664-163-0x0000000004B10000-0x000000000576C000-memory.dmp family_salatstealer behavioral2/memory/6664-166-0x0000000004B10000-0x000000000576C000-memory.dmp family_salatstealer behavioral2/memory/6664-165-0x0000000004B10000-0x000000000576C000-memory.dmp family_salatstealer behavioral2/memory/6664-170-0x0000000004B10000-0x000000000576C000-memory.dmp family_salatstealer - Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 27 IoCs
resource yara_rule behavioral2/memory/7076-34-0x0000000003130000-0x0000000003D8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/7076-35-0x0000000003130000-0x0000000003D8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/7076-36-0x0000000003130000-0x0000000003D8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/7076-39-0x0000000003130000-0x0000000003D8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/7076-37-0x0000000003130000-0x0000000003D8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/7076-40-0x0000000003130000-0x0000000003D8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/7076-41-0x0000000003130000-0x0000000003D8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/7076-42-0x0000000003130000-0x0000000003D8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/7076-52-0x0000000003130000-0x0000000003D8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/3332-90-0x0000000003E50000-0x0000000004AAC000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/3332-91-0x0000000003E50000-0x0000000004AAC000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/3332-93-0x0000000003E50000-0x0000000004AAC000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/3332-92-0x0000000003E50000-0x0000000004AAC000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/3332-95-0x0000000003E50000-0x0000000004AAC000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/3332-94-0x0000000003E50000-0x0000000004AAC000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/3332-96-0x0000000003E50000-0x0000000004AAC000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/3332-97-0x0000000003E50000-0x0000000004AAC000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/3332-98-0x0000000003E50000-0x0000000004AAC000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/3332-99-0x0000000003E50000-0x0000000004AAC000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/3332-111-0x0000000003E50000-0x0000000004AAC000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/3332-142-0x0000000003E50000-0x0000000004AAC000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/6664-162-0x0000000004B10000-0x000000000576C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/6664-164-0x0000000004B10000-0x000000000576C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/6664-163-0x0000000004B10000-0x000000000576C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/6664-166-0x0000000004B10000-0x000000000576C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/6664-165-0x0000000004B10000-0x000000000576C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/6664-170-0x0000000004B10000-0x000000000576C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs - Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 27 IoCs
resource yara_rule behavioral2/memory/7076-34-0x0000000003130000-0x0000000003D8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/7076-35-0x0000000003130000-0x0000000003D8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/7076-36-0x0000000003130000-0x0000000003D8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/7076-39-0x0000000003130000-0x0000000003D8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/7076-37-0x0000000003130000-0x0000000003D8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/7076-40-0x0000000003130000-0x0000000003D8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/7076-41-0x0000000003130000-0x0000000003D8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/7076-42-0x0000000003130000-0x0000000003D8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/7076-52-0x0000000003130000-0x0000000003D8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/3332-90-0x0000000003E50000-0x0000000004AAC000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/3332-91-0x0000000003E50000-0x0000000004AAC000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/3332-93-0x0000000003E50000-0x0000000004AAC000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/3332-92-0x0000000003E50000-0x0000000004AAC000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/3332-95-0x0000000003E50000-0x0000000004AAC000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/3332-94-0x0000000003E50000-0x0000000004AAC000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/3332-96-0x0000000003E50000-0x0000000004AAC000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/3332-97-0x0000000003E50000-0x0000000004AAC000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/3332-98-0x0000000003E50000-0x0000000004AAC000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/3332-99-0x0000000003E50000-0x0000000004AAC000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/3332-111-0x0000000003E50000-0x0000000004AAC000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/3332-142-0x0000000003E50000-0x0000000004AAC000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/6664-162-0x0000000004B10000-0x000000000576C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/6664-164-0x0000000004B10000-0x000000000576C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/6664-163-0x0000000004B10000-0x000000000576C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/6664-166-0x0000000004B10000-0x000000000576C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/6664-165-0x0000000004B10000-0x000000000576C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/6664-170-0x0000000004B10000-0x000000000576C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers - Detects executables containing SQL queries to confidential data stores. Observed in infostealers 27 IoCs
resource yara_rule behavioral2/memory/7076-34-0x0000000003130000-0x0000000003D8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/7076-35-0x0000000003130000-0x0000000003D8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/7076-36-0x0000000003130000-0x0000000003D8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/7076-39-0x0000000003130000-0x0000000003D8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/7076-37-0x0000000003130000-0x0000000003D8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/7076-40-0x0000000003130000-0x0000000003D8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/7076-41-0x0000000003130000-0x0000000003D8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/7076-42-0x0000000003130000-0x0000000003D8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/7076-52-0x0000000003130000-0x0000000003D8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/3332-90-0x0000000003E50000-0x0000000004AAC000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/3332-91-0x0000000003E50000-0x0000000004AAC000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/3332-93-0x0000000003E50000-0x0000000004AAC000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/3332-92-0x0000000003E50000-0x0000000004AAC000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/3332-95-0x0000000003E50000-0x0000000004AAC000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/3332-94-0x0000000003E50000-0x0000000004AAC000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/3332-96-0x0000000003E50000-0x0000000004AAC000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/3332-97-0x0000000003E50000-0x0000000004AAC000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/3332-98-0x0000000003E50000-0x0000000004AAC000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/3332-99-0x0000000003E50000-0x0000000004AAC000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/3332-111-0x0000000003E50000-0x0000000004AAC000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/3332-142-0x0000000003E50000-0x0000000004AAC000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/6664-162-0x0000000004B10000-0x000000000576C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/6664-164-0x0000000004B10000-0x000000000576C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/6664-163-0x0000000004B10000-0x000000000576C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/6664-166-0x0000000004B10000-0x000000000576C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/6664-165-0x0000000004B10000-0x000000000576C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/6664-170-0x0000000004B10000-0x000000000576C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore - UPX dump on OEP (original entry point) 32 IoCs
resource yara_rule behavioral2/memory/7076-15-0x0000000003130000-0x0000000003D8C000-memory.dmp UPX behavioral2/memory/7076-33-0x0000000003130000-0x0000000003D8C000-memory.dmp UPX behavioral2/memory/7076-34-0x0000000003130000-0x0000000003D8C000-memory.dmp UPX behavioral2/memory/7076-35-0x0000000003130000-0x0000000003D8C000-memory.dmp UPX behavioral2/memory/7076-36-0x0000000003130000-0x0000000003D8C000-memory.dmp UPX behavioral2/memory/7076-39-0x0000000003130000-0x0000000003D8C000-memory.dmp UPX behavioral2/memory/7076-37-0x0000000003130000-0x0000000003D8C000-memory.dmp UPX behavioral2/memory/7076-40-0x0000000003130000-0x0000000003D8C000-memory.dmp UPX behavioral2/memory/7076-41-0x0000000003130000-0x0000000003D8C000-memory.dmp UPX behavioral2/memory/7076-42-0x0000000003130000-0x0000000003D8C000-memory.dmp UPX behavioral2/memory/7076-52-0x0000000003130000-0x0000000003D8C000-memory.dmp UPX behavioral2/memory/3332-71-0x0000000003E50000-0x0000000004AAC000-memory.dmp UPX behavioral2/memory/3332-89-0x0000000003E50000-0x0000000004AAC000-memory.dmp UPX behavioral2/memory/3332-90-0x0000000003E50000-0x0000000004AAC000-memory.dmp UPX behavioral2/memory/3332-91-0x0000000003E50000-0x0000000004AAC000-memory.dmp UPX behavioral2/memory/3332-93-0x0000000003E50000-0x0000000004AAC000-memory.dmp UPX behavioral2/memory/3332-92-0x0000000003E50000-0x0000000004AAC000-memory.dmp UPX behavioral2/memory/3332-95-0x0000000003E50000-0x0000000004AAC000-memory.dmp UPX behavioral2/memory/3332-94-0x0000000003E50000-0x0000000004AAC000-memory.dmp UPX behavioral2/memory/3332-96-0x0000000003E50000-0x0000000004AAC000-memory.dmp UPX behavioral2/memory/3332-97-0x0000000003E50000-0x0000000004AAC000-memory.dmp UPX behavioral2/memory/3332-98-0x0000000003E50000-0x0000000004AAC000-memory.dmp UPX behavioral2/memory/3332-99-0x0000000003E50000-0x0000000004AAC000-memory.dmp UPX behavioral2/memory/3332-111-0x0000000003E50000-0x0000000004AAC000-memory.dmp UPX behavioral2/memory/6664-134-0x0000000004B10000-0x000000000576C000-memory.dmp UPX behavioral2/memory/3332-142-0x0000000003E50000-0x0000000004AAC000-memory.dmp UPX behavioral2/memory/6664-162-0x0000000004B10000-0x000000000576C000-memory.dmp UPX behavioral2/memory/6664-164-0x0000000004B10000-0x000000000576C000-memory.dmp UPX behavioral2/memory/6664-163-0x0000000004B10000-0x000000000576C000-memory.dmp UPX behavioral2/memory/6664-166-0x0000000004B10000-0x000000000576C000-memory.dmp UPX behavioral2/memory/6664-165-0x0000000004B10000-0x000000000576C000-memory.dmp UPX behavioral2/memory/6664-170-0x0000000004B10000-0x000000000576C000-memory.dmp UPX - Executes dropped EXE 2 IoCs
pid Process 3332 smss.exe 6664 smss.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
resource yara_rule behavioral2/memory/7076-15-0x0000000003130000-0x0000000003D8C000-memory.dmp upx behavioral2/memory/7076-33-0x0000000003130000-0x0000000003D8C000-memory.dmp upx behavioral2/memory/7076-34-0x0000000003130000-0x0000000003D8C000-memory.dmp upx behavioral2/memory/7076-35-0x0000000003130000-0x0000000003D8C000-memory.dmp upx behavioral2/memory/7076-36-0x0000000003130000-0x0000000003D8C000-memory.dmp upx behavioral2/memory/7076-39-0x0000000003130000-0x0000000003D8C000-memory.dmp upx behavioral2/memory/7076-37-0x0000000003130000-0x0000000003D8C000-memory.dmp upx behavioral2/memory/7076-40-0x0000000003130000-0x0000000003D8C000-memory.dmp upx behavioral2/memory/7076-41-0x0000000003130000-0x0000000003D8C000-memory.dmp upx behavioral2/memory/7076-42-0x0000000003130000-0x0000000003D8C000-memory.dmp upx behavioral2/memory/7076-52-0x0000000003130000-0x0000000003D8C000-memory.dmp upx behavioral2/memory/3332-71-0x0000000003E50000-0x0000000004AAC000-memory.dmp upx behavioral2/memory/3332-89-0x0000000003E50000-0x0000000004AAC000-memory.dmp upx behavioral2/memory/3332-90-0x0000000003E50000-0x0000000004AAC000-memory.dmp upx behavioral2/memory/3332-91-0x0000000003E50000-0x0000000004AAC000-memory.dmp upx behavioral2/memory/3332-93-0x0000000003E50000-0x0000000004AAC000-memory.dmp upx behavioral2/memory/3332-92-0x0000000003E50000-0x0000000004AAC000-memory.dmp upx behavioral2/memory/3332-95-0x0000000003E50000-0x0000000004AAC000-memory.dmp upx behavioral2/memory/3332-94-0x0000000003E50000-0x0000000004AAC000-memory.dmp upx behavioral2/memory/3332-96-0x0000000003E50000-0x0000000004AAC000-memory.dmp upx behavioral2/memory/3332-97-0x0000000003E50000-0x0000000004AAC000-memory.dmp upx behavioral2/memory/3332-98-0x0000000003E50000-0x0000000004AAC000-memory.dmp upx behavioral2/memory/3332-99-0x0000000003E50000-0x0000000004AAC000-memory.dmp upx behavioral2/memory/3332-111-0x0000000003E50000-0x0000000004AAC000-memory.dmp upx behavioral2/memory/6664-134-0x0000000004B10000-0x000000000576C000-memory.dmp upx behavioral2/memory/3332-142-0x0000000003E50000-0x0000000004AAC000-memory.dmp upx behavioral2/memory/6664-162-0x0000000004B10000-0x000000000576C000-memory.dmp upx behavioral2/memory/6664-164-0x0000000004B10000-0x000000000576C000-memory.dmp upx behavioral2/memory/6664-163-0x0000000004B10000-0x000000000576C000-memory.dmp upx behavioral2/memory/6664-166-0x0000000004B10000-0x000000000576C000-memory.dmp upx behavioral2/memory/6664-165-0x0000000004B10000-0x000000000576C000-memory.dmp upx behavioral2/memory/6664-170-0x0000000004B10000-0x000000000576C000-memory.dmp upx - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\smss.exe smss.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-12_6ad4c1353e79e1d4fa7dde09dc67e831_akira_amadey_elex_glassworm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe - Suspicious behavior: EnumeratesProcesses 44 IoCs
pid Process 7076 2026-08-12_6ad4c1353e79e1d4fa7dde09dc67e831_akira_amadey_elex_glassworm.exe 7076 2026-08-12_6ad4c1353e79e1d4fa7dde09dc67e831_akira_amadey_elex_glassworm.exe 7076 2026-08-12_6ad4c1353e79e1d4fa7dde09dc67e831_akira_amadey_elex_glassworm.exe 7076 2026-08-12_6ad4c1353e79e1d4fa7dde09dc67e831_akira_amadey_elex_glassworm.exe 3332 smss.exe 3332 smss.exe 3332 smss.exe 3332 smss.exe 3332 smss.exe 3332 smss.exe 3332 smss.exe 3332 smss.exe 4200 powershell.exe 3332 smss.exe 3332 smss.exe 4200 powershell.exe 3332 smss.exe 3332 smss.exe 3332 smss.exe 3332 smss.exe 3332 smss.exe 3332 smss.exe 3332 smss.exe 3332 smss.exe 3332 smss.exe 3332 smss.exe 3332 smss.exe 3332 smss.exe 3332 smss.exe 3332 smss.exe 3332 smss.exe 3332 smss.exe 3332 smss.exe 3332 smss.exe 3332 smss.exe 3332 smss.exe 3332 smss.exe 3332 smss.exe 3332 smss.exe 3332 smss.exe 3332 smss.exe 3332 smss.exe 3332 smss.exe 3332 smss.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3332 smss.exe Token: SeDebugPrivilege 4200 powershell.exe Token: SeIncreaseQuotaPrivilege 4200 powershell.exe Token: SeSecurityPrivilege 4200 powershell.exe Token: SeTakeOwnershipPrivilege 4200 powershell.exe Token: SeLoadDriverPrivilege 4200 powershell.exe Token: SeSystemProfilePrivilege 4200 powershell.exe Token: SeSystemtimePrivilege 4200 powershell.exe Token: SeProfSingleProcessPrivilege 4200 powershell.exe Token: SeIncBasePriorityPrivilege 4200 powershell.exe Token: SeCreatePagefilePrivilege 4200 powershell.exe Token: SeBackupPrivilege 4200 powershell.exe Token: SeRestorePrivilege 4200 powershell.exe Token: SeShutdownPrivilege 4200 powershell.exe Token: SeDebugPrivilege 4200 powershell.exe Token: SeSystemEnvironmentPrivilege 4200 powershell.exe Token: SeRemoteShutdownPrivilege 4200 powershell.exe Token: SeUndockPrivilege 4200 powershell.exe Token: SeManageVolumePrivilege 4200 powershell.exe Token: 33 4200 powershell.exe Token: 34 4200 powershell.exe Token: 35 4200 powershell.exe Token: 36 4200 powershell.exe Token: SeIncreaseQuotaPrivilege 4200 powershell.exe Token: SeSecurityPrivilege 4200 powershell.exe Token: SeTakeOwnershipPrivilege 4200 powershell.exe Token: SeLoadDriverPrivilege 4200 powershell.exe Token: SeSystemProfilePrivilege 4200 powershell.exe Token: SeSystemtimePrivilege 4200 powershell.exe Token: SeProfSingleProcessPrivilege 4200 powershell.exe Token: SeIncBasePriorityPrivilege 4200 powershell.exe Token: SeCreatePagefilePrivilege 4200 powershell.exe Token: SeBackupPrivilege 4200 powershell.exe Token: SeRestorePrivilege 4200 powershell.exe Token: SeShutdownPrivilege 4200 powershell.exe Token: SeDebugPrivilege 4200 powershell.exe Token: SeSystemEnvironmentPrivilege 4200 powershell.exe Token: SeRemoteShutdownPrivilege 4200 powershell.exe Token: SeUndockPrivilege 4200 powershell.exe Token: SeManageVolumePrivilege 4200 powershell.exe Token: 33 4200 powershell.exe Token: 34 4200 powershell.exe Token: 35 4200 powershell.exe Token: 36 4200 powershell.exe Token: SeIncreaseQuotaPrivilege 4200 powershell.exe Token: SeSecurityPrivilege 4200 powershell.exe Token: SeTakeOwnershipPrivilege 4200 powershell.exe Token: SeLoadDriverPrivilege 4200 powershell.exe Token: SeSystemProfilePrivilege 4200 powershell.exe Token: SeSystemtimePrivilege 4200 powershell.exe Token: SeProfSingleProcessPrivilege 4200 powershell.exe Token: SeIncBasePriorityPrivilege 4200 powershell.exe Token: SeCreatePagefilePrivilege 4200 powershell.exe Token: SeBackupPrivilege 4200 powershell.exe Token: SeRestorePrivilege 4200 powershell.exe Token: SeShutdownPrivilege 4200 powershell.exe Token: SeDebugPrivilege 4200 powershell.exe Token: SeSystemEnvironmentPrivilege 4200 powershell.exe Token: SeRemoteShutdownPrivilege 4200 powershell.exe Token: SeUndockPrivilege 4200 powershell.exe Token: SeManageVolumePrivilege 4200 powershell.exe Token: 33 4200 powershell.exe Token: 34 4200 powershell.exe Token: 35 4200 powershell.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 7076 wrote to memory of 3332 7076 2026-08-12_6ad4c1353e79e1d4fa7dde09dc67e831_akira_amadey_elex_glassworm.exe 92 PID 3332 wrote to memory of 4200 3332 smss.exe 93 PID 3332 wrote to memory of 6664 3332 smss.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-12_6ad4c1353e79e1d4fa7dde09dc67e831_akira_amadey_elex_glassworm.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-12_6ad4c1353e79e1d4fa7dde09dc67e831_akira_amadey_elex_glassworm.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:7076 -
C:\Users\Admin\AppData\Local\Temp\smss.exeC:\Users\Admin\AppData\Local\Temp\smss.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\smss.exe"C:\Program Files (x86)\Microsoft\Edge\Application\smss.exe" -3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6664
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:7148
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\svc_a25aa79f.log
- Size 1KB
- SHA256 d60e5859ba448338bbaea66b5f92c20de1eebf5adb77d9b4e1a4be339e8b63f5
- MD5 f7e0b34d4fa288cf755874fa168c9b63
- SHA1 33a2e28aeb63d1190fd16828020aac3237778f4b
- SHA512 1db967ae572f13778f4533576de71f1fa7cdc4da79a84b067c21f5e8dbe5438f57bbca7e9cce2254c199abe975b6d55bfe685859092409d306a0f6077c95140e
- TLSH T19731E20005A4E2EB48C1C572F4586DBE33939D9778972C1E9232B2CDE9C589BF349DB9
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\svc_a25aa79f.log
- Size 1KB
- SHA256 992686d8587a445fd7c88f1c58f1b66ff815f3d9046b3b9af5a2d51e8bb67158
- MD5 dcfae8890544dfdab33e236a090ecd01
- SHA1 88d5d824850246cd66e77605897e61721eda4674
- SHA512 3e574e6d411b2367fdc95330ac13f396a6a8b62f5bdfe9b0599f241503e9c3ad478b05c2cc5b9f9195a312569ee71e4c01c59d3037aff7ce8f47c3f9fe9297f1
- TLSH T11D41161005A4A2E748C08572F4582DBE33539DD77987281E8231F6CDE8C589BF348EB9
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\svc_a25aa79f.log
- Size 666B
- SHA256 b24e621db5d5d7a0385ace73e8d31f15dfac439b56673d407b902dcf50e970b6
- MD5 01b9cce0d8185aba4bbb67201cd10691
- SHA1 f21246d4bd308e74e2bbd97a1980f4299f707852
- SHA512 a9decf8bcbf0d2d5ca2aebd4f22e5cf910a7c05b78c4222922fb0798955030b770349e0e014148bdfffb002fd4fa3a343531e71eec56b528454b98268cb17f72
- TLSH T10F01F61005A4A2E748C08572F4182DBE37539DD77997281E9231F6CDE9C589BF348EB8
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\svc_a25aa79f.log
- Size 1KB
- SHA256 32fd3c70a850eaf1f662a2298a3702c202ad9a5a90ead6191cbbb6984b0f03a5
- MD5 3ae9516ad510d53905f86b897026232c
- SHA1 c3529d390b16c8792736ee1ee33d0043bd1001e1
- SHA512 d6144fe58818df8ea2b6b0522f9368f9dd0c6fbbde82a70e7b8c035c231486f1b4dc51db12a7bfcb762552afebf90b890ee72ebe7d70a5f6e6b362e029e63d7c
- TLSH T11511E40005A4E2EB48C1C572F4585DBE33939D9778532C1E9232B2CDE9C5897F349DB8
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\svc_a25aa79f.log
- Size 393B
- SHA256 f0fa3613f3a227b8241c9bd9f2be44c488113e857736353ade3ad6da96a3390a
- MD5 623f3e2cafe75ba7c85e9a15d7e9c32c
- SHA1 587391bc8da6ac2caa9a41476c2bacb9c355619d
- SHA512 0c135e0b70ad4c7f9795d469dfdd2e563fe9d8eafb016232a9edbdabf74ab3f4e387954157fcd525ce93577773cd185f4a7d2043f95bfbf650b8b7d012daf13e
- TLSH T15DE05A000454E6DA8CC5D531F8688E3E73A19DABA8532D1A523272CCE9C58D7F34DCF9
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\svc_a25aa79f.log
- Size 1KB
- SHA256 4d80754cd43dfa79fa8ae1acc5d4124587c6cd9c7ff8bd4ac925fc9b438e5b3b
- MD5 9ccc1dc1fa806ad99a27ac869356eb20
- SHA1 07181c47412d4eaa6fdeb769de1939141054d28b
- SHA512 15ddeac2cfe7d27ae97e04481c1a8ea70b4b5d7acbf7dfd6ef370c56de3e3766c0650988ec47fa4a81f749f895eb34627193d999f39c4fb16b8f9ce663494bf3
- TLSH T1E421F61005A4A2E748C08572F4582DBE37539DD77987281E9231F6CDE9C589BF348EB9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\smss.exe
- Size 4.2MB
- SHA256 8233cc8398dee13ac7548ad7aab92b0655b40dfc0af60142d79b7a9d09acab23
- MD5 6ad4c1353e79e1d4fa7dde09dc67e831
- SHA1 cb83d3be1b2644be0489d03d8d2f13f0157da2b3
- SHA512 c699c5b85b38db5266577b7d13d694904604aa9f4d5fbb75932501bfd372a51c4d9ef13a529a160231fc86b498ce60bf9abfd29514b127337c54aa7913c81652
- SSDEEP 49152:X/v8lFhT2YXQTAv7lkO5DdGntR2lYooZaZ8Bqe6XyGaRDkZNUuHtWKBwFosu7SjP:XX8lF/Xv5DgtR2lYooq8MpyVoNUGijC
- TLSH T1111602033BFEB06EEA6B97B494A463454625FC770D51C18A35CC149B0F9B6407EBC2BA
- MD5 SHA1 SHA512 SSDEEP TLSH