Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/08/2026, 00:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-14_0103e15aa4fd014b7014136576055b32_akira_elex_glassworm.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-14_0103e15aa4fd014b7014136576055b32_akira_elex_glassworm.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
General
- Target 2026-08-14_0103e15aa4fd014b7014136576055b32_akira_elex_glassworm.exe
- Size 17.3MB
- Sample260815-avafsaware
- SHA256 bbc12c92d56bce9e77815d507ad7175dcbedf5f3c850dcd96b77089a5e83f697
- MD5 0103e15aa4fd014b7014136576055b32
- SHA1 c3b134a9e175ee4c88b361cfd11d829acac1e77d
- SHA512 1397ee2e95fb2afe8ec272da53fc6ab462b0e119d97c7f924ffd5d2d87df2f8ea8c3e8a959522b52b8159648b17a8e7c93381845ee58467d9128e1a98ab4f9e3
- SSDEEP 24576:a2ENKFWAejVRtW3HxwtjrrAODYuYLHc9Jill/EexrhWEoVDQo+t8XNGQcgMpj9+T:wljVGq
- TLSH T14107EB2EB51C43771ADB07A1872EA4C6B23B725EB79F09CCA05CD261235B46487FBC94
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 29 IoCs
resource yara_rule behavioral2/memory/924-6-0x0000000001DA0000-0x00000000029F4000-memory.dmp family_salatstealer behavioral2/memory/924-10-0x0000000001DA0000-0x00000000029F4000-memory.dmp family_salatstealer behavioral2/memory/924-8-0x0000000001DA0000-0x00000000029F4000-memory.dmp family_salatstealer behavioral2/memory/924-9-0x0000000001DA0000-0x00000000029F4000-memory.dmp family_salatstealer behavioral2/memory/924-5-0x0000000001DA0000-0x00000000029F4000-memory.dmp family_salatstealer behavioral2/memory/924-7-0x0000000001DA0000-0x00000000029F4000-memory.dmp family_salatstealer behavioral2/memory/924-12-0x0000000001DA0000-0x00000000029F4000-memory.dmp family_salatstealer behavioral2/memory/924-13-0x0000000001DA0000-0x00000000029F4000-memory.dmp family_salatstealer behavioral2/memory/924-15-0x0000000001DA0000-0x00000000029F4000-memory.dmp family_salatstealer behavioral2/memory/924-16-0x0000000001DA0000-0x00000000029F4000-memory.dmp family_salatstealer behavioral2/memory/924-22-0x0000000001DA0000-0x00000000029F4000-memory.dmp family_salatstealer behavioral2/memory/3316-35-0x0000000002110000-0x0000000002D64000-memory.dmp family_salatstealer behavioral2/memory/3316-36-0x0000000002110000-0x0000000002D64000-memory.dmp family_salatstealer behavioral2/memory/3316-40-0x0000000002110000-0x0000000002D64000-memory.dmp family_salatstealer behavioral2/memory/3316-38-0x0000000002110000-0x0000000002D64000-memory.dmp family_salatstealer behavioral2/memory/3316-37-0x0000000002110000-0x0000000002D64000-memory.dmp family_salatstealer behavioral2/memory/3316-39-0x0000000002110000-0x0000000002D64000-memory.dmp family_salatstealer behavioral2/memory/3316-42-0x0000000002110000-0x0000000002D64000-memory.dmp family_salatstealer behavioral2/memory/3316-43-0x0000000002110000-0x0000000002D64000-memory.dmp family_salatstealer behavioral2/memory/3316-45-0x0000000002110000-0x0000000002D64000-memory.dmp family_salatstealer behavioral2/memory/3316-48-0x0000000002110000-0x0000000002D64000-memory.dmp family_salatstealer behavioral2/memory/3316-49-0x0000000002110000-0x0000000002D64000-memory.dmp family_salatstealer behavioral2/memory/3316-64-0x0000000002110000-0x0000000002D64000-memory.dmp family_salatstealer behavioral2/memory/5560-89-0x0000000002380000-0x0000000002FD4000-memory.dmp family_salatstealer behavioral2/memory/5560-90-0x0000000002380000-0x0000000002FD4000-memory.dmp family_salatstealer behavioral2/memory/5560-88-0x0000000002380000-0x0000000002FD4000-memory.dmp family_salatstealer behavioral2/memory/5560-92-0x0000000002380000-0x0000000002FD4000-memory.dmp family_salatstealer behavioral2/memory/5560-91-0x0000000002380000-0x0000000002FD4000-memory.dmp family_salatstealer behavioral2/memory/5560-94-0x0000000002380000-0x0000000002FD4000-memory.dmp family_salatstealer - Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 29 IoCs
resource yara_rule behavioral2/memory/924-6-0x0000000001DA0000-0x00000000029F4000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/924-10-0x0000000001DA0000-0x00000000029F4000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/924-8-0x0000000001DA0000-0x00000000029F4000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/924-9-0x0000000001DA0000-0x00000000029F4000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/924-5-0x0000000001DA0000-0x00000000029F4000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/924-7-0x0000000001DA0000-0x00000000029F4000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/924-12-0x0000000001DA0000-0x00000000029F4000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/924-13-0x0000000001DA0000-0x00000000029F4000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/924-15-0x0000000001DA0000-0x00000000029F4000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/924-16-0x0000000001DA0000-0x00000000029F4000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/924-22-0x0000000001DA0000-0x00000000029F4000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/3316-35-0x0000000002110000-0x0000000002D64000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/3316-36-0x0000000002110000-0x0000000002D64000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/3316-40-0x0000000002110000-0x0000000002D64000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/3316-38-0x0000000002110000-0x0000000002D64000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/3316-37-0x0000000002110000-0x0000000002D64000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/3316-39-0x0000000002110000-0x0000000002D64000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/3316-42-0x0000000002110000-0x0000000002D64000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/3316-43-0x0000000002110000-0x0000000002D64000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/3316-45-0x0000000002110000-0x0000000002D64000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/3316-48-0x0000000002110000-0x0000000002D64000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/3316-49-0x0000000002110000-0x0000000002D64000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/3316-64-0x0000000002110000-0x0000000002D64000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/5560-89-0x0000000002380000-0x0000000002FD4000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/5560-90-0x0000000002380000-0x0000000002FD4000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/5560-88-0x0000000002380000-0x0000000002FD4000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/5560-92-0x0000000002380000-0x0000000002FD4000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/5560-91-0x0000000002380000-0x0000000002FD4000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/5560-94-0x0000000002380000-0x0000000002FD4000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs - Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 29 IoCs
resource yara_rule behavioral2/memory/924-6-0x0000000001DA0000-0x00000000029F4000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/924-10-0x0000000001DA0000-0x00000000029F4000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/924-8-0x0000000001DA0000-0x00000000029F4000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/924-9-0x0000000001DA0000-0x00000000029F4000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/924-5-0x0000000001DA0000-0x00000000029F4000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/924-7-0x0000000001DA0000-0x00000000029F4000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/924-12-0x0000000001DA0000-0x00000000029F4000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/924-13-0x0000000001DA0000-0x00000000029F4000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/924-15-0x0000000001DA0000-0x00000000029F4000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/924-16-0x0000000001DA0000-0x00000000029F4000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/924-22-0x0000000001DA0000-0x00000000029F4000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/3316-35-0x0000000002110000-0x0000000002D64000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/3316-36-0x0000000002110000-0x0000000002D64000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/3316-40-0x0000000002110000-0x0000000002D64000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/3316-38-0x0000000002110000-0x0000000002D64000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/3316-37-0x0000000002110000-0x0000000002D64000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/3316-39-0x0000000002110000-0x0000000002D64000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/3316-42-0x0000000002110000-0x0000000002D64000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/3316-43-0x0000000002110000-0x0000000002D64000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/3316-45-0x0000000002110000-0x0000000002D64000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/3316-48-0x0000000002110000-0x0000000002D64000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/3316-49-0x0000000002110000-0x0000000002D64000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/3316-64-0x0000000002110000-0x0000000002D64000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5560-89-0x0000000002380000-0x0000000002FD4000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5560-90-0x0000000002380000-0x0000000002FD4000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5560-88-0x0000000002380000-0x0000000002FD4000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5560-92-0x0000000002380000-0x0000000002FD4000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5560-91-0x0000000002380000-0x0000000002FD4000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5560-94-0x0000000002380000-0x0000000002FD4000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers - Detects executables containing SQL queries to confidential data stores. Observed in infostealers 29 IoCs
resource yara_rule behavioral2/memory/924-6-0x0000000001DA0000-0x00000000029F4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/924-10-0x0000000001DA0000-0x00000000029F4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/924-8-0x0000000001DA0000-0x00000000029F4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/924-9-0x0000000001DA0000-0x00000000029F4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/924-5-0x0000000001DA0000-0x00000000029F4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/924-7-0x0000000001DA0000-0x00000000029F4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/924-12-0x0000000001DA0000-0x00000000029F4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/924-13-0x0000000001DA0000-0x00000000029F4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/924-15-0x0000000001DA0000-0x00000000029F4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/924-16-0x0000000001DA0000-0x00000000029F4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/924-22-0x0000000001DA0000-0x00000000029F4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/3316-35-0x0000000002110000-0x0000000002D64000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/3316-36-0x0000000002110000-0x0000000002D64000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/3316-40-0x0000000002110000-0x0000000002D64000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/3316-38-0x0000000002110000-0x0000000002D64000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/3316-37-0x0000000002110000-0x0000000002D64000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/3316-39-0x0000000002110000-0x0000000002D64000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/3316-42-0x0000000002110000-0x0000000002D64000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/3316-43-0x0000000002110000-0x0000000002D64000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/3316-45-0x0000000002110000-0x0000000002D64000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/3316-48-0x0000000002110000-0x0000000002D64000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/3316-49-0x0000000002110000-0x0000000002D64000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/3316-64-0x0000000002110000-0x0000000002D64000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/5560-89-0x0000000002380000-0x0000000002FD4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/5560-90-0x0000000002380000-0x0000000002FD4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/5560-88-0x0000000002380000-0x0000000002FD4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/5560-92-0x0000000002380000-0x0000000002FD4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/5560-91-0x0000000002380000-0x0000000002FD4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/5560-94-0x0000000002380000-0x0000000002FD4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore - UPX dump on OEP (original entry point) 34 IoCs
resource yara_rule behavioral2/memory/924-0-0x0000000001DA0000-0x00000000029F4000-memory.dmp UPX behavioral2/memory/924-4-0x0000000001DA0000-0x00000000029F4000-memory.dmp UPX behavioral2/memory/924-6-0x0000000001DA0000-0x00000000029F4000-memory.dmp UPX behavioral2/memory/924-10-0x0000000001DA0000-0x00000000029F4000-memory.dmp UPX behavioral2/memory/924-8-0x0000000001DA0000-0x00000000029F4000-memory.dmp UPX behavioral2/memory/924-9-0x0000000001DA0000-0x00000000029F4000-memory.dmp UPX behavioral2/memory/924-5-0x0000000001DA0000-0x00000000029F4000-memory.dmp UPX behavioral2/memory/924-7-0x0000000001DA0000-0x00000000029F4000-memory.dmp UPX behavioral2/memory/924-12-0x0000000001DA0000-0x00000000029F4000-memory.dmp UPX behavioral2/memory/924-13-0x0000000001DA0000-0x00000000029F4000-memory.dmp UPX behavioral2/memory/924-15-0x0000000001DA0000-0x00000000029F4000-memory.dmp UPX behavioral2/memory/924-16-0x0000000001DA0000-0x00000000029F4000-memory.dmp UPX behavioral2/memory/924-22-0x0000000001DA0000-0x00000000029F4000-memory.dmp UPX behavioral2/memory/3316-30-0x0000000002110000-0x0000000002D64000-memory.dmp UPX behavioral2/memory/3316-34-0x0000000002110000-0x0000000002D64000-memory.dmp UPX behavioral2/memory/3316-35-0x0000000002110000-0x0000000002D64000-memory.dmp UPX behavioral2/memory/3316-36-0x0000000002110000-0x0000000002D64000-memory.dmp UPX behavioral2/memory/3316-40-0x0000000002110000-0x0000000002D64000-memory.dmp UPX behavioral2/memory/3316-38-0x0000000002110000-0x0000000002D64000-memory.dmp UPX behavioral2/memory/3316-37-0x0000000002110000-0x0000000002D64000-memory.dmp UPX behavioral2/memory/3316-39-0x0000000002110000-0x0000000002D64000-memory.dmp UPX behavioral2/memory/3316-42-0x0000000002110000-0x0000000002D64000-memory.dmp UPX behavioral2/memory/3316-43-0x0000000002110000-0x0000000002D64000-memory.dmp UPX behavioral2/memory/3316-45-0x0000000002110000-0x0000000002D64000-memory.dmp UPX behavioral2/memory/3316-48-0x0000000002110000-0x0000000002D64000-memory.dmp UPX behavioral2/memory/3316-49-0x0000000002110000-0x0000000002D64000-memory.dmp UPX behavioral2/memory/3316-64-0x0000000002110000-0x0000000002D64000-memory.dmp UPX behavioral2/memory/5560-79-0x0000000002380000-0x0000000002FD4000-memory.dmp UPX behavioral2/memory/5560-89-0x0000000002380000-0x0000000002FD4000-memory.dmp UPX behavioral2/memory/5560-90-0x0000000002380000-0x0000000002FD4000-memory.dmp UPX behavioral2/memory/5560-88-0x0000000002380000-0x0000000002FD4000-memory.dmp UPX behavioral2/memory/5560-92-0x0000000002380000-0x0000000002FD4000-memory.dmp UPX behavioral2/memory/5560-91-0x0000000002380000-0x0000000002FD4000-memory.dmp UPX behavioral2/memory/5560-94-0x0000000002380000-0x0000000002FD4000-memory.dmp UPX - Executes dropped EXE 2 IoCs
pid Process 3316 ShellHost.exe 5560 ShellHost.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
resource yara_rule behavioral2/memory/924-0-0x0000000001DA0000-0x00000000029F4000-memory.dmp upx behavioral2/memory/924-4-0x0000000001DA0000-0x00000000029F4000-memory.dmp upx behavioral2/memory/924-6-0x0000000001DA0000-0x00000000029F4000-memory.dmp upx behavioral2/memory/924-10-0x0000000001DA0000-0x00000000029F4000-memory.dmp upx behavioral2/memory/924-8-0x0000000001DA0000-0x00000000029F4000-memory.dmp upx behavioral2/memory/924-9-0x0000000001DA0000-0x00000000029F4000-memory.dmp upx behavioral2/memory/924-5-0x0000000001DA0000-0x00000000029F4000-memory.dmp upx behavioral2/memory/924-7-0x0000000001DA0000-0x00000000029F4000-memory.dmp upx behavioral2/memory/924-12-0x0000000001DA0000-0x00000000029F4000-memory.dmp upx behavioral2/memory/924-13-0x0000000001DA0000-0x00000000029F4000-memory.dmp upx behavioral2/memory/924-15-0x0000000001DA0000-0x00000000029F4000-memory.dmp upx behavioral2/memory/924-16-0x0000000001DA0000-0x00000000029F4000-memory.dmp upx behavioral2/memory/924-22-0x0000000001DA0000-0x00000000029F4000-memory.dmp upx behavioral2/memory/3316-30-0x0000000002110000-0x0000000002D64000-memory.dmp upx behavioral2/memory/3316-34-0x0000000002110000-0x0000000002D64000-memory.dmp upx behavioral2/memory/3316-35-0x0000000002110000-0x0000000002D64000-memory.dmp upx behavioral2/memory/3316-36-0x0000000002110000-0x0000000002D64000-memory.dmp upx behavioral2/memory/3316-40-0x0000000002110000-0x0000000002D64000-memory.dmp upx behavioral2/memory/3316-38-0x0000000002110000-0x0000000002D64000-memory.dmp upx behavioral2/memory/3316-37-0x0000000002110000-0x0000000002D64000-memory.dmp upx behavioral2/memory/3316-39-0x0000000002110000-0x0000000002D64000-memory.dmp upx behavioral2/memory/3316-42-0x0000000002110000-0x0000000002D64000-memory.dmp upx behavioral2/memory/3316-43-0x0000000002110000-0x0000000002D64000-memory.dmp upx behavioral2/memory/3316-45-0x0000000002110000-0x0000000002D64000-memory.dmp upx behavioral2/memory/3316-48-0x0000000002110000-0x0000000002D64000-memory.dmp upx behavioral2/memory/3316-49-0x0000000002110000-0x0000000002D64000-memory.dmp upx behavioral2/memory/3316-64-0x0000000002110000-0x0000000002D64000-memory.dmp upx behavioral2/memory/5560-79-0x0000000002380000-0x0000000002FD4000-memory.dmp upx behavioral2/memory/5560-89-0x0000000002380000-0x0000000002FD4000-memory.dmp upx behavioral2/memory/5560-90-0x0000000002380000-0x0000000002FD4000-memory.dmp upx behavioral2/memory/5560-88-0x0000000002380000-0x0000000002FD4000-memory.dmp upx behavioral2/memory/5560-92-0x0000000002380000-0x0000000002FD4000-memory.dmp upx behavioral2/memory/5560-91-0x0000000002380000-0x0000000002FD4000-memory.dmp upx behavioral2/memory/5560-94-0x0000000002380000-0x0000000002FD4000-memory.dmp upx - Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\6d3fc026-a38e-40d1-9d24-c118290426a3 2026-08-14_0103e15aa4fd014b7014136576055b32_akira_elex_glassworm.exe File opened for modification C:\Program Files (x86)\Adobe\ShellHost.exe 2026-08-14_0103e15aa4fd014b7014136576055b32_akira_elex_glassworm.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\ShellHost.exe ShellHost.exe File opened for modification C:\Program Files (x86)\Windows NT\6d3fc026-a38e-40d1-9d24-c118290426a3 2026-08-14_0103e15aa4fd014b7014136576055b32_akira_elex_glassworm.exe File opened for modification C:\Program Files (x86)\Windows NT\WUDFHost.exe 2026-08-14_0103e15aa4fd014b7014136576055b32_akira_elex_glassworm.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ShellHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-14_0103e15aa4fd014b7014136576055b32_akira_elex_glassworm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ShellHost.exe - Suspicious behavior: EnumeratesProcesses 44 IoCs
pid Process 924 2026-08-14_0103e15aa4fd014b7014136576055b32_akira_elex_glassworm.exe 924 2026-08-14_0103e15aa4fd014b7014136576055b32_akira_elex_glassworm.exe 924 2026-08-14_0103e15aa4fd014b7014136576055b32_akira_elex_glassworm.exe 924 2026-08-14_0103e15aa4fd014b7014136576055b32_akira_elex_glassworm.exe 3316 ShellHost.exe 3316 ShellHost.exe 3316 ShellHost.exe 3316 ShellHost.exe 3316 ShellHost.exe 3316 ShellHost.exe 3316 ShellHost.exe 3316 ShellHost.exe 4744 powershell.exe 4744 powershell.exe 3316 ShellHost.exe 3316 ShellHost.exe 3316 ShellHost.exe 3316 ShellHost.exe 3316 ShellHost.exe 3316 ShellHost.exe 3316 ShellHost.exe 3316 ShellHost.exe 3316 ShellHost.exe 3316 ShellHost.exe 3316 ShellHost.exe 3316 ShellHost.exe 3316 ShellHost.exe 3316 ShellHost.exe 3316 ShellHost.exe 3316 ShellHost.exe 3316 ShellHost.exe 3316 ShellHost.exe 3316 ShellHost.exe 3316 ShellHost.exe 3316 ShellHost.exe 3316 ShellHost.exe 3316 ShellHost.exe 3316 ShellHost.exe 3316 ShellHost.exe 3316 ShellHost.exe 3316 ShellHost.exe 3316 ShellHost.exe 3316 ShellHost.exe 3316 ShellHost.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3316 ShellHost.exe Token: SeDebugPrivilege 4744 powershell.exe Token: SeIncreaseQuotaPrivilege 4744 powershell.exe Token: SeSecurityPrivilege 4744 powershell.exe Token: SeTakeOwnershipPrivilege 4744 powershell.exe Token: SeLoadDriverPrivilege 4744 powershell.exe Token: SeSystemProfilePrivilege 4744 powershell.exe Token: SeSystemtimePrivilege 4744 powershell.exe Token: SeProfSingleProcessPrivilege 4744 powershell.exe Token: SeIncBasePriorityPrivilege 4744 powershell.exe Token: SeCreatePagefilePrivilege 4744 powershell.exe Token: SeBackupPrivilege 4744 powershell.exe Token: SeRestorePrivilege 4744 powershell.exe Token: SeShutdownPrivilege 4744 powershell.exe Token: SeDebugPrivilege 4744 powershell.exe Token: SeSystemEnvironmentPrivilege 4744 powershell.exe Token: SeRemoteShutdownPrivilege 4744 powershell.exe Token: SeUndockPrivilege 4744 powershell.exe Token: SeManageVolumePrivilege 4744 powershell.exe Token: 33 4744 powershell.exe Token: 34 4744 powershell.exe Token: 35 4744 powershell.exe Token: 36 4744 powershell.exe Token: SeIncreaseQuotaPrivilege 4744 powershell.exe Token: SeSecurityPrivilege 4744 powershell.exe Token: SeTakeOwnershipPrivilege 4744 powershell.exe Token: SeLoadDriverPrivilege 4744 powershell.exe Token: SeSystemProfilePrivilege 4744 powershell.exe Token: SeSystemtimePrivilege 4744 powershell.exe Token: SeProfSingleProcessPrivilege 4744 powershell.exe Token: SeIncBasePriorityPrivilege 4744 powershell.exe Token: SeCreatePagefilePrivilege 4744 powershell.exe Token: SeBackupPrivilege 4744 powershell.exe Token: SeRestorePrivilege 4744 powershell.exe Token: SeShutdownPrivilege 4744 powershell.exe Token: SeDebugPrivilege 4744 powershell.exe Token: SeSystemEnvironmentPrivilege 4744 powershell.exe Token: SeRemoteShutdownPrivilege 4744 powershell.exe Token: SeUndockPrivilege 4744 powershell.exe Token: SeManageVolumePrivilege 4744 powershell.exe Token: 33 4744 powershell.exe Token: 34 4744 powershell.exe Token: 35 4744 powershell.exe Token: 36 4744 powershell.exe Token: SeIncreaseQuotaPrivilege 4744 powershell.exe Token: SeSecurityPrivilege 4744 powershell.exe Token: SeTakeOwnershipPrivilege 4744 powershell.exe Token: SeLoadDriverPrivilege 4744 powershell.exe Token: SeSystemProfilePrivilege 4744 powershell.exe Token: SeSystemtimePrivilege 4744 powershell.exe Token: SeProfSingleProcessPrivilege 4744 powershell.exe Token: SeIncBasePriorityPrivilege 4744 powershell.exe Token: SeCreatePagefilePrivilege 4744 powershell.exe Token: SeBackupPrivilege 4744 powershell.exe Token: SeRestorePrivilege 4744 powershell.exe Token: SeShutdownPrivilege 4744 powershell.exe Token: SeDebugPrivilege 4744 powershell.exe Token: SeSystemEnvironmentPrivilege 4744 powershell.exe Token: SeRemoteShutdownPrivilege 4744 powershell.exe Token: SeUndockPrivilege 4744 powershell.exe Token: SeManageVolumePrivilege 4744 powershell.exe Token: 33 4744 powershell.exe Token: 34 4744 powershell.exe Token: 35 4744 powershell.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 924 wrote to memory of 3316 924 2026-08-14_0103e15aa4fd014b7014136576055b32_akira_elex_glassworm.exe 90 PID 3316 wrote to memory of 4744 3316 ShellHost.exe 92 PID 3316 wrote to memory of 5560 3316 ShellHost.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_0103e15aa4fd014b7014136576055b32_akira_elex_glassworm.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-14_0103e15aa4fd014b7014136576055b32_akira_elex_glassworm.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Program Files (x86)\Adobe\ShellHost.exe"C:\Program Files (x86)\Adobe\ShellHost.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\ShellHost.exe"C:\Program Files (x86)\Microsoft\Edge\Application\ShellHost.exe" -3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5560
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:5860
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Adobe\ShellHost.exe
- Size 17.3MB
- SHA256 bbc12c92d56bce9e77815d507ad7175dcbedf5f3c850dcd96b77089a5e83f697
- MD5 0103e15aa4fd014b7014136576055b32
- SHA1 c3b134a9e175ee4c88b361cfd11d829acac1e77d
- SHA512 1397ee2e95fb2afe8ec272da53fc6ab462b0e119d97c7f924ffd5d2d87df2f8ea8c3e8a959522b52b8159648b17a8e7c93381845ee58467d9128e1a98ab4f9e3
- SSDEEP 24576:a2ENKFWAejVRtW3HxwtjrrAODYuYLHc9Jill/EexrhWEoVDQo+t8XNGQcgMpj9+T:wljVGq
- TLSH T14107EB2EB51C43771ADB07A1872EA4C6B23B725EB79F09CCA05CD261235B46487FBC94
- MD5 SHA1 SHA512 SSDEEP TLSH