Analysis
- max time kernel
150s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
16/08/2026, 09:25
General
- Target 2026-08-16_f7994a06dcce527d0d9a0fe4323b9f51_akira_amadey_blankgrabber_elex_glassworm.exe
- Size 47.3MB
- Sample260816-ldwhgavamd
- SHA256 36a7f5e454ee7a0823ca7045a834d2d72962a95740ff399b26b94c68e4ad60de
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 13 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 6 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-16_f7994a06dcce527d0d9a0fe4323b9f51_akira_amadey_blankgrabber_elex_glassworm.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-16_f7994a06dcce527d0d9a0fe4323b9f51_akira_amadey_blankgrabber_elex_glassworm.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\KugouAvaloniaPlayer\current\KugouAvaloniaPlayer.exe"C:\Users\Admin\AppData\Local\KugouAvaloniaPlayer\current\KugouAvaloniaPlayer.exe" --veloapp-install 3.4.12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\KugouAvaloniaPlayer\current\KugouAvaloniaPlayer.exe"C:\Users\Admin\AppData\Local\KugouAvaloniaPlayer\current\KugouAvaloniaPlayer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
heart_grey.ico
heart_red.ico
next.ico
pause.ico
play.ico
prev.ico
KugouTaskbarNative.dll
av_libGLESv2.dll
bass.DLL
bass_aac.dll
bass_fx.DLL
bassape.dll
bassdsd.dll
bassflac.dll
bassloud.dll
basswebm.dll
e_sqlite3.DLL
libHarfBuzzSharp.DLL
libSkiaSharp.DLL
sq.version
KugouAvaloniaPlayer-3.4.1-full.nupkg
velopack_KugouAvaloniaPlayer.log
memory/3320-74-0x00007FFB25FD0000-0x00007FFB25FE0000-memory.dmp
memory/3320-69-0x00007FFB24540000-0x00007FFB24554000-memory.dmp
memory/3320-77-0x00007FFB1DD70000-0x00007FFB1DD8B000-memory.dmp
memory/3320-64-0x00007FFB12CF0000-0x00007FFB12D4C000-memory.dmp
memory/3320-48-0x0000024695130000-0x0000024695140000-memory.dmp