Analysis
- max time kernel
149s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
20/08/2026, 09:21
General
- Target 2026-08-20_faab983804205476eeb638ac8b8e7665_akira_glassworm_rusty-stealer.exe
- Size 23.4MB
- Sample260820-lbj2natcng
- SHA256 cfab590bd3294e78fbdd2dd52ccfb7ac083add08c2303508c26193cf9080dd8e
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_faab983804205476eeb638ac8b8e7665_akira_glassworm_rusty-stealer.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_faab983804205476eeb638ac8b8e7665_akira_glassworm_rusty-stealer.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\conhost.exe\\?\C:\Windows\system32\conhost.exe --headless --width 99 --height 28 --signal 0x524 --server 0x51c2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3444-17-0x000001A1B1220000-0x000001A1B1242000-memory.dmp
memory/3444-18-0x000001A1C99E0000-0x000001A1C9A28000-memory.dmp
memory/4912-2-0x00000167C6030000-0x00000167C6031000-memory.dmp
memory/4912-0-0x00000167C6030000-0x00000167C6031000-memory.dmp
memory/4912-9-0x00000167C6030000-0x00000167C6031000-memory.dmp
memory/4912-10-0x00000167C6030000-0x00000167C6031000-memory.dmp
memory/4912-8-0x00000167C6030000-0x00000167C6031000-memory.dmp
memory/4912-7-0x00000167C6030000-0x00000167C6031000-memory.dmp
memory/4912-6-0x00000167C6030000-0x00000167C6031000-memory.dmp
memory/4912-11-0x00000167C6030000-0x00000167C6031000-memory.dmp