Analysis
- max time kernel
148s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
19/08/2026, 22:18
General
- Target 2026-08-19_a573f6f6fe0b8a7db4f8a002271612ee_akira_glassworm_icedid_luca-stealer_njrat_rusty-stealer.exe
- Size 7.5MB
- Sample260819-176mvsap61
- SHA256 64d6925c0c945e4867e62a6218ab12415de10354471a99ccf32150b4efb36f8d
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_a573f6f6fe0b8a7db4f8a002271612ee_akira_glassworm_icedid_luca-stealer_njrat_rusty-stealer.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_a573f6f6fe0b8a7db4f8a002271612ee_akira_glassworm_icedid_luca-stealer_njrat_rusty-stealer.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -NoProfile -STA -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $taskName = 'NeedleRemoteAgent' $exePath = '\\?\C:\Users\Admin\AppData\Local\Temp\2026-08-19_a573f6f6fe0b8a7db4f8a002271612ee_akira_glassworm_icedid_luca-stealer_njrat_rusty-stealer.exe' $workDir = '\\?\C:\Users\Admin\AppData\Local\Temp' $existing = Get-ScheduledTask -TaskName $taskName -ErrorAction SilentlyContinue if ($existing) { $action = $existing.Actions | Select-Object -First 1 if ($action.Execute -eq $exePath) { exit 0 } Unregister-ScheduledTask -TaskName $taskName -Confirm:$false } $action = New-ScheduledTaskAction -Execute $exePath -WorkingDirectory $workDir $trigger = New-ScheduledTaskTrigger -AtLogOn -User $env:USERNAME $trigger.Delay = 'PT30S' $settings = New-ScheduledTaskSettingsSet ` -AllowStartIfOnBatteries ` -DontStopIfGoingOnBatteries ` -StartWhenAvailable ` -RestartCount 999 ` -RestartInterval (New-TimeSpan -Seconds 10) ` -ExecutionTimeLimit ([TimeSpan]::Zero) ` -MultipleInstances IgnoreNew $principal = New-ScheduledTaskPrincipal -UserId $env:USERNAME -LogonType Interactive -RunLevel Limited Register-ScheduledTask -TaskName $taskName -Action $action -Trigger $trigger -Settings $settings -Principal $principal -Force | Out-Null "2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/460-0-0x00007FFD1A67F000-0x00007FFD1A680000-memory.dmp
memory/460-1-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
memory/460-4-0x0000014C14DC0000-0x0000014C14DE2000-memory.dmp
memory/460-5-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
memory/460-6-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
memory/460-7-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
memory/460-8-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
memory/460-9-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
memory/460-10-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
memory/460-11-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
memory/460-12-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
memory/460-15-0x0000014C2D620000-0x0000014C2D63E000-memory.dmp
memory/460-16-0x0000014C2D640000-0x0000014C2D6F2000-memory.dmp
memory/460-17-0x0000014C2D400000-0x0000014C2D40A000-memory.dmp
memory/460-18-0x0000014C2D970000-0x0000014C2D98E000-memory.dmp
memory/460-19-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
memory/460-20-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
memory/460-22-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp