17ab3bcefb0f735e892c836940957a3c6a43a482e373ec1263258d9748c6ed8f

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/09/2026, 02:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-12_45a10c4fd0cb6064f547e2c468cc1f8b_glassworm_megazord_njrat.exe
Size 68.3MB
Sample260913-c6c26aea83
SHA256 17ab3bcefb0f735e892c836940957a3c6a43a482e373ec1263258d9748c6ed8f
MD5 45a10c4fd0cb6064f547e2c468cc1f8b
SHA1 64d1b3e424c32f954ed37cb785850aa00f7766eb
SHA512 6972298ca9f9895de3f742357ec7b75aab21130c30b191a298d5adec8b2194aebc8229e38baf41807ee33f4c4a8d9c9de617fba51fc6e4b800713bce3b130d4e
SSDEEP 786432:XO8Zq0Zu537FDOu8Dybxc4WV5OtsFUtasY/:XPQFDHSyDWGs/
TLSH
T1A0F7BF15A3D80A16E67FC27DC2638102E7F1B4931352D7CF0468EA992F53BC1AB77266
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion execution

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral1/files/0x00080000000244b1-3.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
behavioral1/files/0x00080000000244b1-3.dat	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral1/files/0x00080000000244b1-3.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables referencing combination of virtualization drivers 1 IoCs

resource	yara_rule
behavioral1/files/0x00080000000244b1-3.dat	INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
behavioral1/files/0x00080000000244b1-3.dat	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Enumerates VirtualBox registry keys 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	rj6na26exw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	rj6na26exw.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	rj6na26exw.exe

Looks for VirtualBox drivers on disk 2 TTPs 1 IoCs

defense_evasion

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\Windows\System32\Drivers\VBoxGuest.sys	rj6na26exw.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1032	powershell.exe
1032	powershell.exe

Looks for VMWare drivers on disk 2 TTPs 1 IoCs

defense_evasion

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	rj6na26exw.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rj6na26exw.exe

Executes dropped EXE 1 IoCs

pid	Process
1132	rj6na26exw.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VBoxVersion	rj6na26exw.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1032	powershell.exe
1032	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1032	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 1132	4464	2026-09-12_45a10c4fd0cb6064f547e2c468cc1f8b_glassworm_megazord_njrat.exe	86
PID 1132 wrote to memory of 1032	1132	rj6na26exw.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-09-12_45a10c4fd0cb6064f547e2c468cc1f8b_glassworm_megazord_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-12_45a10c4fd0cb6064f547e2c468cc1f8b_glassworm_megazord_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Users\Admin\AppData\Local\Temp\rj6na26exw.exe
  "C:\Users\Admin\AppData\Local\Temp\rj6na26exw.exe"
  2⤵
  - Enumerates VirtualBox registry keys
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VirtualBox drivers on disk
  - Looks for VMWare drivers on disk
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Enumerates system info in registry
  - Suspicious use of WriteProcessMemory
  PID:1132
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -ErrorAction SilentlyContinue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

File and Directory Discovery

T1083

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_pehwem53.svi.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pehwem53.svi.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

rj6na26exw.exe

Path C:\Users\Admin\AppData\Local\Temp\rj6na26exw.exe
Size 4.0MB
SHA256 44a651709348d871888075b3685feed905caadbaeda19d21d487c570c025ddf4
MD5 36009f4c71e74f2a094116e419e5a4aa
SHA1 0471266a7a188828c728d1ed6cabb280fc1c9341
SHA512 712e0cfd775a66fefebcc46308af53ac45844c04c1d263526f28412663953b9b03bc21c41ac39b4900724ec1a3474e698dff0521d4353b63b80dbdf4c1e425b4
SSDEEP 49152:3fdVkbs/K4mRjG1YkkV+KGS2BW+r8wFY3v7xvud8V5ma0XfQcRICSBndyudfcnD6:3dtYKQ0vIvXapS77O9bGDD
TLSH
T19B167D43FA9581E9C09EC178C72A9233EB72BC8D4620B79B67D44A212F53F605F5E354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1032-6-0x000002031DFF0000-0x000002031E000000-memory.dmp

Download

memory/1032-5-0x000002031DFF0000-0x000002031E000000-memory.dmp

Download

memory/1032-7-0x0000020339F60000-0x0000020339F82000-memory.dmp

Download

memory/1032-15-0x000002031DFF0000-0x000002031E000000-memory.dmp

Download