5dd45ab244f9621f56f70e79a32257e468c0ccbdab49388606e63dbc740abc09

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 16:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_5a9c4ba5b947f4d112f93d967b78466a_akira_glassworm_icedid_rusty-stealer.exe
Size 2.3MB
Sample260910-t2dassvvaz
SHA256 5dd45ab244f9621f56f70e79a32257e468c0ccbdab49388606e63dbc740abc09
MD5 5a9c4ba5b947f4d112f93d967b78466a
SHA1 8c6556c152bd9a8b4d65cf1239272d2a7b3c3896
SHA512 5289a4010ac05a8ddb0acc63307093774c263190b494cbba09ecc21169790db326cccea1e3632890d9d38032323f86bff3a0f1fde6ca89478c34a2b481000068
SSDEEP 24576:leXB3PZXoPdNcNCZ8Vrz1b5ZYI/E99H3r6IDjMgDFfIbd4:oXBBXoPANCZOz1boiE9BTD4glI
TLSH
T1D5B5FB93A2DC5CF6C51A84BBAD278913B1367A9BB01EA4670EFFEB341DD7B601706110
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion execution

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 4 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	reg.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3048	powershell.exe
3360	powershell.exe
1112	powershell.exe
1112	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	reg.exe

Looks for VMWare services registry key. 1 TTPs 1 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	reg.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1184	sc.exe
6012	sc.exe
2612	sc.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4448	cmd.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
932	reg.exe
3180	reg.exe
2064	reg.exe
1564	reg.exe
1988	reg.exe
4204	reg.exe
52	reg.exe
4764	reg.exe
2020	reg.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
4440	wmic.exe
4440	wmic.exe
4440	wmic.exe
4440	wmic.exe
3472	2026-09-10_5a9c4ba5b947f4d112f93d967b78466a_akira_glassworm_icedid_rusty-stealer.exe
3472	2026-09-10_5a9c4ba5b947f4d112f93d967b78466a_akira_glassworm_icedid_rusty-stealer.exe
3472	2026-09-10_5a9c4ba5b947f4d112f93d967b78466a_akira_glassworm_icedid_rusty-stealer.exe
3472	2026-09-10_5a9c4ba5b947f4d112f93d967b78466a_akira_glassworm_icedid_rusty-stealer.exe
3048	powershell.exe
3048	powershell.exe
3360	powershell.exe
3360	powershell.exe
1112	powershell.exe
1112	powershell.exe
3048	powershell.exe
3360	powershell.exe
1112	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4440	wmic.exe
Token: SeSecurityPrivilege	4440	wmic.exe
Token: SeTakeOwnershipPrivilege	4440	wmic.exe
Token: SeLoadDriverPrivilege	4440	wmic.exe
Token: SeSystemProfilePrivilege	4440	wmic.exe
Token: SeSystemtimePrivilege	4440	wmic.exe
Token: SeProfSingleProcessPrivilege	4440	wmic.exe
Token: SeIncBasePriorityPrivilege	4440	wmic.exe
Token: SeCreatePagefilePrivilege	4440	wmic.exe
Token: SeBackupPrivilege	4440	wmic.exe
Token: SeRestorePrivilege	4440	wmic.exe
Token: SeShutdownPrivilege	4440	wmic.exe
Token: SeDebugPrivilege	4440	wmic.exe
Token: SeSystemEnvironmentPrivilege	4440	wmic.exe
Token: SeRemoteShutdownPrivilege	4440	wmic.exe
Token: SeUndockPrivilege	4440	wmic.exe
Token: SeManageVolumePrivilege	4440	wmic.exe
Token: 33	4440	wmic.exe
Token: 34	4440	wmic.exe
Token: 35	4440	wmic.exe
Token: 36	4440	wmic.exe
Token: SeIncreaseQuotaPrivilege	4440	wmic.exe
Token: SeSecurityPrivilege	4440	wmic.exe
Token: SeTakeOwnershipPrivilege	4440	wmic.exe
Token: SeLoadDriverPrivilege	4440	wmic.exe
Token: SeSystemProfilePrivilege	4440	wmic.exe
Token: SeSystemtimePrivilege	4440	wmic.exe
Token: SeProfSingleProcessPrivilege	4440	wmic.exe
Token: SeIncBasePriorityPrivilege	4440	wmic.exe
Token: SeCreatePagefilePrivilege	4440	wmic.exe
Token: SeBackupPrivilege	4440	wmic.exe
Token: SeRestorePrivilege	4440	wmic.exe
Token: SeShutdownPrivilege	4440	wmic.exe
Token: SeDebugPrivilege	4440	wmic.exe
Token: SeSystemEnvironmentPrivilege	4440	wmic.exe
Token: SeRemoteShutdownPrivilege	4440	wmic.exe
Token: SeUndockPrivilege	4440	wmic.exe
Token: SeManageVolumePrivilege	4440	wmic.exe
Token: 33	4440	wmic.exe
Token: 34	4440	wmic.exe
Token: 35	4440	wmic.exe
Token: 36	4440	wmic.exe
Token: SeDebugPrivilege	3048	powershell.exe
Token: SeDebugPrivilege	3360	powershell.exe
Token: SeDebugPrivilege	1112	powershell.exe
Token: SeIncreaseQuotaPrivilege	1112	powershell.exe
Token: SeSecurityPrivilege	1112	powershell.exe
Token: SeTakeOwnershipPrivilege	1112	powershell.exe
Token: SeLoadDriverPrivilege	1112	powershell.exe
Token: SeSystemProfilePrivilege	1112	powershell.exe
Token: SeSystemtimePrivilege	1112	powershell.exe
Token: SeProfSingleProcessPrivilege	1112	powershell.exe
Token: SeIncBasePriorityPrivilege	1112	powershell.exe
Token: SeCreatePagefilePrivilege	1112	powershell.exe
Token: SeBackupPrivilege	1112	powershell.exe
Token: SeRestorePrivilege	1112	powershell.exe
Token: SeShutdownPrivilege	1112	powershell.exe
Token: SeDebugPrivilege	1112	powershell.exe
Token: SeSystemEnvironmentPrivilege	1112	powershell.exe
Token: SeRemoteShutdownPrivilege	1112	powershell.exe
Token: SeUndockPrivilege	1112	powershell.exe
Token: SeManageVolumePrivilege	1112	powershell.exe
Token: 33	1112	powershell.exe
Token: 34	1112	powershell.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 3472 wrote to memory of 4448	3472	2026-09-10_5a9c4ba5b947f4d112f93d967b78466a_akira_glassworm_icedid_rusty-stealer.exe	88
PID 3472 wrote to memory of 1184	3472	2026-09-10_5a9c4ba5b947f4d112f93d967b78466a_akira_glassworm_icedid_rusty-stealer.exe	90
PID 3472 wrote to memory of 4440	3472	2026-09-10_5a9c4ba5b947f4d112f93d967b78466a_akira_glassworm_icedid_rusty-stealer.exe	93
PID 3472 wrote to memory of 5012	3472	2026-09-10_5a9c4ba5b947f4d112f93d967b78466a_akira_glassworm_icedid_rusty-stealer.exe	96
PID 3472 wrote to memory of 4152	3472	2026-09-10_5a9c4ba5b947f4d112f93d967b78466a_akira_glassworm_icedid_rusty-stealer.exe	98
PID 3472 wrote to memory of 932	3472	2026-09-10_5a9c4ba5b947f4d112f93d967b78466a_akira_glassworm_icedid_rusty-stealer.exe	100
PID 3472 wrote to memory of 4204	3472	2026-09-10_5a9c4ba5b947f4d112f93d967b78466a_akira_glassworm_icedid_rusty-stealer.exe	102
PID 3472 wrote to memory of 3180	3472	2026-09-10_5a9c4ba5b947f4d112f93d967b78466a_akira_glassworm_icedid_rusty-stealer.exe	104
PID 3472 wrote to memory of 52	3472	2026-09-10_5a9c4ba5b947f4d112f93d967b78466a_akira_glassworm_icedid_rusty-stealer.exe	106
PID 3472 wrote to memory of 4764	3472	2026-09-10_5a9c4ba5b947f4d112f93d967b78466a_akira_glassworm_icedid_rusty-stealer.exe	108
PID 3472 wrote to memory of 2064	3472	2026-09-10_5a9c4ba5b947f4d112f93d967b78466a_akira_glassworm_icedid_rusty-stealer.exe	110
PID 3472 wrote to memory of 1564	3472	2026-09-10_5a9c4ba5b947f4d112f93d967b78466a_akira_glassworm_icedid_rusty-stealer.exe	112
PID 3472 wrote to memory of 1988	3472	2026-09-10_5a9c4ba5b947f4d112f93d967b78466a_akira_glassworm_icedid_rusty-stealer.exe	114
PID 3472 wrote to memory of 2020	3472	2026-09-10_5a9c4ba5b947f4d112f93d967b78466a_akira_glassworm_icedid_rusty-stealer.exe	117
PID 3472 wrote to memory of 3048	3472	2026-09-10_5a9c4ba5b947f4d112f93d967b78466a_akira_glassworm_icedid_rusty-stealer.exe	118
PID 3472 wrote to memory of 1112	3472	2026-09-10_5a9c4ba5b947f4d112f93d967b78466a_akira_glassworm_icedid_rusty-stealer.exe	119
PID 3472 wrote to memory of 3360	3472	2026-09-10_5a9c4ba5b947f4d112f93d967b78466a_akira_glassworm_icedid_rusty-stealer.exe	120
PID 3472 wrote to memory of 6012	3472	2026-09-10_5a9c4ba5b947f4d112f93d967b78466a_akira_glassworm_icedid_rusty-stealer.exe	125
PID 3472 wrote to memory of 2612	3472	2026-09-10_5a9c4ba5b947f4d112f93d967b78466a_akira_glassworm_icedid_rusty-stealer.exe	127

C:\Users\Admin\AppData\Local\Temp\2026-09-10_5a9c4ba5b947f4d112f93d967b78466a_akira_glassworm_icedid_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_5a9c4ba5b947f4d112f93d967b78466a_akira_glassworm_icedid_rusty-stealer.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Windows\system32\cmd.exe
  "cmd" /C echo "Service started successfully"
  2⤵
  - Executes a command shell one-liner
  PID:4448
- C:\Windows\system32\sc.exe
  "sc" query RpcSs
  2⤵
  - Launches sc.exe
  PID:1184
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" os get Caption,Version,BuildNumber
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4440
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools"
  2⤵
  - Looks for VMWare Tools registry key
  PID:5012
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions"
  2⤵
  - Looks for VirtualBox Guest Additions in registry
  PID:4152
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest
  2⤵
  - Enumerates VirtualBox registry keys
  - Modifies registry key
  PID:932
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Services\VBoxMouse
  2⤵
  - Enumerates VirtualBox registry keys
  - Modifies registry key
  PID:4204
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Services\VBoxSF
  2⤵
  - Enumerates VirtualBox registry keys
  - Modifies registry key
  PID:3180
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Services\VBoxVideo
  2⤵
  - Enumerates VirtualBox registry keys
  - Modifies registry key
  PID:52
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Services\vmhgfs
  2⤵
  - Modifies registry key
  PID:4764
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Services\vmci
  2⤵
  - Looks for VMWare services registry key.
  - Modifies registry key
  PID:2064
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Services\vmxnet3
  2⤵
  - Modifies registry key
  PID:1564
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Services\vmx_svga
  2⤵
  - Modifies registry key
  PID:1988
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:2020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -WindowStyle Hidden -Command "Get-PnpDevice -Class Image -ErrorAction SilentlyContinue | Where-Object {$_.Status -eq 'OK'} | Measure-Object | Select-Object -ExpandProperty Count"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -WindowStyle Hidden -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct -ErrorAction SilentlyContinue | Select-Object -ExpandProperty displayName"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -WindowStyle Hidden -Command ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3360
- C:\Windows\system32\sc.exe
  "sc" query Winmgmt
  2⤵
  - Launches sc.exe
  PID:6012
- C:\Windows\system32\sc.exe
  "sc" query Winmgmt
  2⤵
  - Launches sc.exe
  PID:2612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2706f7a3cde18304b8eb65dc0fa6d884f09a46a78e320302afda951d20885534
MD5 dc6571b4e39d13392bb7f996d9a95ef5
SHA1 a1838cd4f6a2a1ff743489171ba9f83c662362c7
SHA512 5e2582268c12399a5b29751932d896eb47931478bbafa197faf15d26470a589e1892887a85e7061e431ad8163259ee00682e34c167e9ca204ffd33c888a35f63
TLSH
T199219833F3DC8214CC99003A10DDAC1036B6C7CB40DECF9B6B85E159A82F298DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 6fa817959ced0745e6525d7d02cb46169d523bede9e98875e86985bd6c7c813d
MD5 b8bd38654857618ffdea2144de769df7
SHA1 1ae0dd8a7216accb59f8ae0014edc1e067277a8f
SHA512 9eb121904823346aa8f1abe4e331f9a389883b0f32b2dfb6111ae8d12b7f4787ed984f3c191f28117f2230e0bbff7845453f2046ffe516c9117538fd37d41490
TLSH
T16B216833B3DD8625CC9A413A10CDAC1036BAC7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_xj5rku3e.2l3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xj5rku3e.2l3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1112-10-0x000001C8FAAC0000-0x000001C8FAADE000-memory.dmp

Download

memory/1112-13-0x000001C8FAAE0000-0x000001C8FAB92000-memory.dmp

Download

memory/1112-14-0x000001C8FA8A0000-0x000001C8FA8AA000-memory.dmp

Download

memory/1112-15-0x000001C8FAD20000-0x000001C8FAD4A000-memory.dmp

Download

memory/1112-16-0x000001C8FAD20000-0x000001C8FAD44000-memory.dmp

Download

memory/3048-4-0x000001F25F990000-0x000001F25F9B2000-memory.dmp

Download

memory/3048-19-0x000001F260030000-0x000001F26004E000-memory.dmp

Download