Analysis
- max time kernel
150s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
16/09/2026, 21:19
General
- Target 2026-09-16_5c56a7a3aa2efc5d3861ec487d05b161_akira_elex_glassworm_vidar.exe
- Size 17.4MB
- Sample260916-z6b67aed39
- SHA256 aa138cfb300da26bcdcf3b5404fc620acc8665be9386b0686c1befbde886f136
Malware Config
Extracted
-
acrstealer
-
4.2.4-alpha2
-
auth.automationportal.cc
-
gravatar.com
-
ddrs
https://telegra.ph/Parameters-04-03
-
guids
f1575b64-8492-4e8b-b102-4d26e8c70371
019ea1fa-f436-794b-bca5-1b63d0a80336
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36
Signatures
- Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
- Detects ACRStealer V4.x 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-16_5c56a7a3aa2efc5d3861ec487d05b161_akira_elex_glassworm_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-16_5c56a7a3aa2efc5d3861ec487d05b161_akira_elex_glassworm_vidar.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1920-0-0x0000000003510000-0x0000000003580000-memory.dmp
memory/1920-1-0x00000000FF550000-0x00000000FF551000-memory.dmp
memory/1920-4-0x00000000FF550000-0x00000000FF551000-memory.dmp
memory/1920-15-0x00000000FF550000-0x00000000FF551000-memory.dmp
memory/1920-7-0x00000000FF550000-0x00000000FF551000-memory.dmp
memory/1920-6-0x00000000FF550000-0x00000000FF551000-memory.dmp
memory/1920-11-0x00000000FF550000-0x00000000FF551000-memory.dmp
memory/1920-9-0x00000000FF550000-0x00000000FF551000-memory.dmp
memory/1920-23-0x00000000FF550000-0x00000000FF551000-memory.dmp
memory/1920-580-0x0000000077B38000-0x0000000077B39000-memory.dmp
memory/1920-1195-0x0000000003510000-0x0000000003580000-memory.dmp
memory/1920-1232-0x0000000003510000-0x0000000003580000-memory.dmp
memory/1920-1225-0x0000000003510000-0x0000000003580000-memory.dmp
memory/1920-1238-0x0000000003510000-0x0000000003580000-memory.dmp
memory/1920-1277-0x0000000003510000-0x0000000003580000-memory.dmp
memory/1920-1292-0x0000000003510000-0x0000000003580000-memory.dmp
memory/1920-1335-0x0000000003510000-0x0000000003580000-memory.dmp
memory/1920-1357-0x0000000003510000-0x0000000003580000-memory.dmp
memory/1920-1386-0x0000000003510000-0x0000000003580000-memory.dmp
memory/1920-1428-0x0000000003510000-0x0000000003580000-memory.dmp
memory/1920-1420-0x0000000003510000-0x0000000003580000-memory.dmp
memory/1920-1413-0x0000000003510000-0x0000000003580000-memory.dmp
memory/1920-1405-0x0000000003510000-0x0000000003580000-memory.dmp
memory/1920-1394-0x0000000003510000-0x0000000003580000-memory.dmp
memory/1920-1379-0x0000000003510000-0x0000000003580000-memory.dmp
memory/1920-1371-0x0000000003510000-0x0000000003580000-memory.dmp
memory/1920-1364-0x0000000003510000-0x0000000003580000-memory.dmp
memory/1920-1350-0x0000000003510000-0x0000000003580000-memory.dmp
memory/1920-1343-0x0000000003510000-0x0000000003580000-memory.dmp
memory/1920-1315-0x0000000003510000-0x0000000003580000-memory.dmp
memory/1920-1328-0x0000000003510000-0x0000000003580000-memory.dmp
memory/1920-1321-0x0000000003510000-0x0000000003580000-memory.dmp
memory/1920-1306-0x0000000003510000-0x0000000003580000-memory.dmp
memory/1920-1299-0x0000000003510000-0x0000000003580000-memory.dmp
memory/1920-1284-0x0000000003510000-0x0000000003580000-memory.dmp
memory/1920-1269-0x0000000003510000-0x0000000003580000-memory.dmp
memory/1920-1268-0x0000000003510000-0x0000000003580000-memory.dmp
memory/1920-1261-0x0000000003510000-0x0000000003580000-memory.dmp
memory/1920-1254-0x0000000003510000-0x0000000003580000-memory.dmp
memory/1920-1218-0x0000000003510000-0x0000000003580000-memory.dmp
memory/1920-1211-0x0000000003510000-0x0000000003580000-memory.dmp
memory/1920-1204-0x0000000003510000-0x0000000003580000-memory.dmp
memory/1920-1197-0x00000000FF550000-0x00000000FF551000-memory.dmp
memory/1920-1192-0x00000000FF550000-0x00000000FF551000-memory.dmp
memory/1920-1189-0x00000000FF550000-0x00000000FF551000-memory.dmp
memory/1920-1186-0x00000000FF550000-0x00000000FF551000-memory.dmp
memory/1920-1184-0x00000000FF550000-0x00000000FF551000-memory.dmp
memory/1920-1183-0x00000000FF550000-0x00000000FF551000-memory.dmp
memory/1920-1433-0x00000000FF6B0000-0x00000000FF6F8000-memory.dmp
memory/1920-1446-0x00000000FF710000-0x00000000FF711000-memory.dmp
memory/1920-1447-0x00000000039E0000-0x0000000003A8B000-memory.dmp