Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
25/09/2026, 18:21
General
- Target 2026-09-25_e2d2a0807b28f5083e1c1a21190fd7b1_akira_glassworm_rusty-stealer.exe
- Size 8.7MB
- Sample260925-wzerysgf36
- SHA256 0064ffaa30846af7d6f92533c687c09c1d08f779727f7893e8ad9b5152e33ca6
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-25_e2d2a0807b28f5083e1c1a21190fd7b1_akira_glassworm_rusty-stealer.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-25_e2d2a0807b28f5083e1c1a21190fd7b1_akira_glassworm_rusty-stealer.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -NoProfile -Command "Get-ChildItem Cert:\LocalMachine\Root | ForEach-Object { '-----BEGIN CERTIFICATE-----'; [Convert]::ToBase64String($_.RawData, 'InsertLineBreaks'); '-----END CERTIFICATE-----' }"2⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1060-0-0x00007FF9F42DF000-0x00007FF9F42E0000-memory.dmp
memory/1060-3-0x00007FF9F4150000-0x00007FF9F4AF4000-memory.dmp
memory/1060-4-0x000001AA5ADA0000-0x000001AA5ADC2000-memory.dmp
memory/1060-5-0x00007FF9F4150000-0x00007FF9F4AF4000-memory.dmp
memory/1060-6-0x00007FF9F4150000-0x00007FF9F4AF4000-memory.dmp
memory/1060-7-0x00007FF9F4150000-0x00007FF9F4AF4000-memory.dmp
memory/1060-8-0x00007FF9F4150000-0x00007FF9F4AF4000-memory.dmp
memory/1060-9-0x00007FF9F4150000-0x00007FF9F4AF4000-memory.dmp
memory/1060-10-0x00007FF9F4150000-0x00007FF9F4AF4000-memory.dmp
memory/1060-11-0x00007FF9F4150000-0x00007FF9F4AF4000-memory.dmp
memory/1060-12-0x00007FF9F4150000-0x00007FF9F4AF4000-memory.dmp
memory/1060-13-0x00007FF9F4150000-0x00007FF9F4AF4000-memory.dmp
memory/1060-15-0x00007FF9F4150000-0x00007FF9F4AF4000-memory.dmp
memory/1060-16-0x00007FF9F4150000-0x00007FF9F4AF4000-memory.dmp