0e0847c87848f7623ad3680f9266cbc14001d8702202210398ef8db7df935c36

Analysis

max time kernel
149s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 13:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
Size 4.4MB
Sample261002-qjdxtszset
SHA256 0e0847c87848f7623ad3680f9266cbc14001d8702202210398ef8db7df935c36
MD5 642b7c04ed50a7a7f80687c85e7e8306
SHA1 f1a65ae0e6b411a37115a2f4e925a7b0d88a08d6
SHA512 4e4c5155a2b41f936cfeca53916367d9df49001f08d348ffe2c9e96b6cb2a834cb4ee5ebf830424918b2f5432a28e6962646a2145c3790559da606fddc772e1e
SSDEEP 49152:pxfkunx2VexkuLPLbAvwkWa86/OOsi2yzN4JjLa9OzeQ1uJfuWWNTaSG6EWo1VCM:GXWWdsimvc14O9GHhy
TLSH
T1BD2619117A9FA9EDC199C874834A5A731E21B8CB0B26B9FF41C441353EA9BB41F3D718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (256) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Logo1_.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	rundl132.exe

Executes dropped EXE 3 IoCs

pid	Process
2512	Logo1_.exe
2284	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
4784	rundl132.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	Logo1_.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
	\??\F:\	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\RCX6E0A.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\RCX6F65.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE.Exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmprph.exe	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe.Exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RCX6879.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RCX68A9.tmp	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\RCX6F44.tmp	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe	Logo1_.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\RCX6EF0.tmp	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\uninstall\rundl132.exe	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
File created	C:\Windows\Logo1_.exe	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
File created	C:\Windows\uninstall\rundl132.exe	Logo1_.exe
File created	C:\Windows\RichDll.dll	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5656	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Logo1_.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundl132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4548	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
4548	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
4548	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
4548	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
4548	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
4548	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
4548	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
4548	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
4548	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
4548	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
4548	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
4548	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
4548	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
4548	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
4548	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
4548	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
4548	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
4548	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
4548	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
4548	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
4548	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
4548	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
4548	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
4548	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
4548	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
4548	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
2512	Logo1_.exe
2512	Logo1_.exe
2512	Logo1_.exe
2512	Logo1_.exe
2512	Logo1_.exe
2512	Logo1_.exe
2512	Logo1_.exe
2512	Logo1_.exe
2512	Logo1_.exe
2512	Logo1_.exe
2512	Logo1_.exe
2512	Logo1_.exe
2512	Logo1_.exe
2512	Logo1_.exe
2512	Logo1_.exe
2512	Logo1_.exe
2512	Logo1_.exe
2512	Logo1_.exe
2512	Logo1_.exe
2512	Logo1_.exe
2512	Logo1_.exe
2512	Logo1_.exe
2512	Logo1_.exe
2512	Logo1_.exe
2512	Logo1_.exe
2512	Logo1_.exe
2512	Logo1_.exe
2512	Logo1_.exe
2512	Logo1_.exe
2512	Logo1_.exe
2512	Logo1_.exe
2512	Logo1_.exe
2512	Logo1_.exe
2512	Logo1_.exe
2512	Logo1_.exe
2512	Logo1_.exe
2512	Logo1_.exe
2512	Logo1_.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 4560	4548	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe	85
PID 4560 wrote to memory of 4644	4560	net.exe	87
PID 4548 wrote to memory of 5656	4548	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe	91
PID 4548 wrote to memory of 2512	4548	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe	92
PID 2512 wrote to memory of 5248	2512	Logo1_.exe	94
PID 5656 wrote to memory of 2284	5656	cmd.exe	96
PID 5248 wrote to memory of 5772	5248	net.exe	97
PID 2512 wrote to memory of 5548	2512	Logo1_.exe	100
PID 5548 wrote to memory of 1248	5548	net.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Windows\SysWOW64\net.exe
  net stop "Kingsoft AntiVirus Service"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4560
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4644
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE67.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5656
- - C:\Users\Admin\AppData\Local\Temp\2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe"
    3⤵
    - Executes dropped EXE
    PID:2284
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5248
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5772
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5548
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1248

C:\Windows\uninstall\rundl132.exe
C:\Windows\uninstall\rundl132.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX6B7A.tmp

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCX6B7A.tmp
Size 94KB
SHA256 1ca761b29602b35cb3cb947422519a0c016946625767ba70f113e16e613a97a0
MD5 3ad7aea349708aa75f2a33d9fa64d14e
SHA1 bd2d54ba6ae1f0faaad5b298c3b028ce1e46a059
SHA512 059f6ee0202a5384432d52eb1c503b4fd981ba113cae672430e97038efaf46e5704dc59852829d876cd2acc938af82e05baa7c05e55b698f1cf2551b4bf23915
SSDEEP 1536:G7qnkAQtSaoGo5n4iLG0/WM6T4HSaYqey/XxAyNYHrnj/5vG4CG0Nb:XCSjGoLpWM6CB/XxAyWH//E3B
TLSH
T17B933959B28CB772D0E155BC8E0FF2E5BD297E301E1D58AFB6991F0EED7A0C10908196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX6C2D.tmp

Path C:\Program Files (x86)\Google\Update\RCX6C2D.tmp
Size 90KB
SHA256 d6bbcf98977003f9e747000acaa3aa55576ed6f8361583fea66d5a9dc59efc0a
MD5 e79f30e559e5978746797bd337e6c79f
SHA1 589fe3ef8ec37f85cc9f45bc3b9b30a5e6745879
SHA512 a5225ffee71b756fba90e8a5d9f3b7f1c59a383629d8afa5f025eb90f1e87efff7c3308a6d2769ccbaee2b9eacb99b0b6c6c134dc4564a0c4dbb06946f99e311
SSDEEP 1536:G7qnkAQtSaoGo5n4iLG0/WM6T4HSaYqey/XxAyNfHrnj/5vG4CGzNr:XCSjGoLpWM6CB/XxAydH//E0R
TLSH
T13E935A69B28CB772D0F159BC9E0DF2E57D297E301E29186FB59E1F0DDA7A1C2090C192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe.Exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe.Exe
Size 103KB
SHA256 eceb0970e302bd1556023e6876d556906506b3c39c736b389b6be2fc909485be
MD5 84cab0365b042b4917c37ac0aa1c9d82
SHA1 9bd1ad7f1e840fa03da6c11d0b1225c95f230f8f
SHA512 1b19d5bcfc7140f3e3ffe4e8e3a58593ccd58606069b01c8e1f021c0a42328f24f3dfb3f552975d7ec67b0520b87eb5887eff0ef52880b5184ea29daa49d7549
SSDEEP 1536:27qnkAQtSaoGo5n4iLG0/WM6T4HSaYqey/XxAyNVHrnj/5vG4CGM1XkSPsULMHiz:nCSjGoLpWM6CB/XxAyXH//ELdtPlLq3G
TLSH
T16AA37B59B2CDB772C0F159BC8E0DF2E57D297E301F19186BB68E1F0E9A7A5C2090C192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX6CAC.tmp

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX6CAC.tmp
Size 118KB
SHA256 a11a8a70f4b232fc0e992702df31428053e14951c304a9daad1b22f0e10d047d
MD5 1e08537f5a4fa22e89af4ffd842b34ca
SHA1 e49411d51847680e608d26083ec40b943ae71779
SHA512 b5dab2651c45ea87f635b1cb651832eea10829ee2ebddf6ede4a89997e39360430655222768ee729e87a9518ab60f0a5f58fde7f8ad435e1be4c64249ba21978
SSDEEP 1536:X7qnkAQtSaoGo5n4iLG0/WM6T4HSaYqey/XxAyNDHrnj/5vG4CGx4GZjzQwK5WWb:mCSjGoLpWM6CB/XxAy9H//Eqe5BV0kv
TLSH
T189C39D65B2CCB3B6C0E159BC8E0DF2E57D29BE301E29186BB59A1F1DC97B1C2590C192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe.Exe

Path C:\Program Files\7-Zip\7z.exe.Exe
Size 642KB
SHA256 5f9098d8bac2b4e1e02ac08adf185c08cb47a6d058b661191eeb09208874c6b5
MD5 330c735a281f66de4bab2f4ba0df1a70
SHA1 c638d310cf2e23795a3b4a489a0171a5e15e8a62
SHA512 868a57b03cbad3763c72fc8df12beb409d42947bf354c3c9ad0d5414fa98136aee14c1ae5ff13cd82ce0fc1444d59c9dcb36b4ea08372035461ba0818047ee0e
SSDEEP 6144:CX7/oZXREiNYVLKZn56Vq2UjCpd0v5prE6v0GSxWUPZl1JP+1Lix7NGZIVuXQ82+:/XZNYVLeyUji0h90ZD0wxpGZIVuKrHs
TLSH
T118E4F815F66CB331D0F2C0B9C5DEB68AED713C411B3089CB5286876C6E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX5C21.tmp

Path C:\Program Files\7-Zip\RCX5C21.tmp
Size 91KB
SHA256 ef7fb3b5272046beba2a377329c6869d5f5ee2c4b2ba4b681b2eba9e883e437b
MD5 bac17a10b124a4e79bda1ebca01652b6
SHA1 336e7ac601b6335fc5f9cca260eb1251a50f81c8
SHA512 f8a57e62f74417735531ac5c873f4a125758c9c6fcd5d88395df7d422652fa0982a6e6e82019ef11af0dbdd64209a47a0114422c55229baa52648be5ecfbeaf8
SSDEEP 1536:m7qnkAQtSaoGo5n4iLG0/WM6T4HSaYqey/XxAyNgHrnj/5vG4CGQNT:3CSjGoLpWM6CB/XxAyuH//E75
TLSH
T158936B59B28DB772D0F159BC8E0DF2E57D297E301E29186FB59E2F0ED97A1C2090C192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX5D80.tmp

Path C:\Program Files\Java\jdk-1.8\bin\RCX5D80.tmp
Size 91KB
SHA256 fad534dd5a73a238b2da29462cf908b449a3e90f1893d7593ccb7512747b9cfa
MD5 5ab7244ad01af808039ce66558978b87
SHA1 1d7c5f4551fd82d5f39d280a0d01ce63274bb90a
SHA512 7f79fd1f2d3c3a5d75c8d257db751acfed866d77afc307e9e48f1a71d3ac45dd54884e4b85aa8787639c434b95deaedb9426e5e26395bb8e26669d8c2a780423
SSDEEP 1536:+7qnkAQtSaoGo5n4iLG0/WM6T4HSaYqey/XxAyN4Hrnj/5vG4CGaND:vCSjGoLpWM6CB/XxAyGH//Ehp
TLSH
T17C934B65B28CB772C0F159BC9E0DF2E57D297E301E29186BB59E3F1D9A7B1C2090C186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX611C.tmp

Path C:\Program Files\Microsoft Office 15\ClientX64\RCX611C.tmp
Size 156KB
SHA256 26f5b7adaafd587a95f2a58ed0ea4e6e781b83370aee62a579f430638c1b99b6
MD5 cfbbae0b9fa0c8c48f3601903cede98e
SHA1 a71fffc967e89ea1735f279b8950a7586ce70db7
SHA512 68befab25703f613f40382de1047ffc3e1570c8927523ebc28a22fa3463006905ea642664026a2b191eeb5f37e5d2cbc33d71a6f5439072094bb7bfe6e53012b
SSDEEP 1536:37qnkAQtSaoGo5n4iLG0/WM6T4HSaYqey/XxAyNzHrnj/5vG4CGPngNL:GCSjGoLpWM6CB/XxAyJH//EKgx
TLSH
T1E6F3D5B5B29CB776D0E199B84D1DF2E16C2D7E201E2BCC6A715A3F0DBB761C11A0818D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX60EB.tmp

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\RCX60EB.tmp
Size 91KB
SHA256 dc17d9651b754b0d985d8ae560e2ace645f24c483f30505d54bab4231e72b40f
MD5 377ae534ea93f0d376bf45699cb94a68
SHA1 a57be69e9bbd37dbcd85c7a6c6c9825abcf55d5b
SHA512 929c27b08235668e07dcfc23e18d4e76e7fa4a032c88765c4c95f1cfb028c5d2e044390442e720d1efd279126147c0be18c13e4d393991ac0094485619a4c173
SSDEEP 1536:O7qnkAQtSaoGo5n4iLG0/WM6T4HSaYqey/XxAyNIHrnj/5vG4CGFND:fCSjGoLpWM6CB/XxAyWH//Emp
TLSH
T1F1935B55B28CB772C0F255BCDE0DF3E57D297E701E2918AB759E2F1E9A7A1C1090C282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX617F.tmp

Path C:\Program Files\Mozilla Firefox\uninstall\RCX617F.tmp
Size 99KB
SHA256 f19d37bb77b2076b598b6a709095ef229a4ed7bef4f0e57d90cdbb1b6d926861
MD5 779c38fcb6f520f12215f0f1727f620d
SHA1 d42646e440558dd7827dfe6c87c9e62b9ecd3ccd
SHA512 c37ba9761704ccdd62cb3baf238aba49a2c5373f8ebdd11068e8911ec93bf4f4b753d91c8296d6507b10b8222ec1dce4d15077967aaf9d972f627f7e4fe28dd5
SSDEEP 1536:e7qnkAQtSaoGo5n4iLG0/WM6T4HSaYqey/XxAyNyTHrnj/5vG4CGeqkSZZZ3LN7:PCSjGoLpWM6CB/XxAyAH//EfULh
TLSH
T19BA36B55B68CB7B2D0F149B89D0DF3E17D29BE301E69186BB29D3F1E9A770C2091C186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX61C0.tmp

Path C:\Program Files\VideoLAN\VLC\RCX61C0.tmp
Size 92KB
SHA256 6d7ab4b097eda87b80b2ae13f995f2769f8ea2b20898d8d9cb57065d8ade5bc4
MD5 7489503433b51e587c4938c95ba0508d
SHA1 1b36419d45f333869c9a1d0787b62f97e6ba35fe
SHA512 d14e0a8a074b317877412fa9c8278912722905115301c794cf3fe1d77df12680e5f0e5d14882a3d7431dc83b77a4ca7e63ed6192df38a032c7e3354e5f724433
SSDEEP 1536:m7qnkAQtSaoGo5n4iLG0/WM6T4HSaYqey/XxAyNgHrnj/5vG4CGlNb:3CSjGoLpWM6CB/XxAyuH//EeB
TLSH
T15F935B69B28CB772D0ED59BC8E0DF2E57D297E301E29186FB59E1F0D997A0C1090C19E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe.Exe

Path C:\Program Files\dotnet\dotnet.exe.Exe
Size 235KB
SHA256 4365063903c9a0f1e7bce37d011b8d80ce5deb6564b314156938667f2a911f33
MD5 01e7a1fa342eb99fbdc7b95120506917
SHA1 1d931cdd8cb80ae28f424261e55d37f0eb0848db
SHA512 d25e4986d0fb13b57a2b795f05438acae759b3c3fa6f85da76cd73b4dacc2bc79d295903b313119b615d502db0f3e50f4e6877a5ae87dc7ceafb6c8d99c2143a
SSDEEP 3072:/CSjGoLpWM6CB/XxAyOH//EWPNvJ9psmeIBcV8pQFq4XKF3QP6:VX7/R83psmeI+sQFqT3Qi
TLSH
T11F34E559E29C73B5C0EE5178CB1DB681BE277C204BE1928B62D4FA3D1F362805DE9643
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX7479.tmp

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\RCX7479.tmp
Size 91KB
SHA256 f9a284c41a183a07d6a600d98d28cb39702a8155810cbc8202ad4f29401977b1
MD5 b699cc1ab2340baea32030f14316f758
SHA1 bf3e39f22c560d3a7f1e90d2c485dc7c4c044d49
SHA512 a71ba4df9c7691f6f9269f7fa72d3bcd34f37a9611ee3918d4b6d94306e66ef264c7b6710275184133578d739959ab58ef7a24a6928a0c4201b41c88743c6cd6
SSDEEP 1536:27qnkAQtSaoGo5n4iLG0/WM6T4HSaYqey/XxAyNOHrnj/5vG4CGSNj:nCSjGoLpWM6CB/XxAyAH//ElJ
TLSH
T156935B65B28CB772D0F195BC8E0DF2E57D297E301E29186BB59E1F1E9E7B0C2490C192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$aCE67.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aCE67.bat
Size 722B
SHA256 82e5b717d5d39c5071faaf46cf73da541571ef68ddcc8c9b720606504fd2222f
MD5 6c7c531f28cb04bdecc2b2e562933fbe
SHA1 82b7c5c4af50aea6c7af85c1a2e15ba621437532
SHA512 1999b0db0049ede891d0a33ea3de027a5edd05f07523cc0f8d260d35b79c65cf7146976cac63ec599b4d5308e2a55a0e89a5dda26a81e9e643002a6d0fceb683
TLSH
T18501B102B957CDA60A8CF143045139CC82312CFE777573095B24ED4E5FA9D5EA8E6381
MD5 SHA1 SHA512 TLSH

Submit Download

2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe.exe
Size 4.3MB
SHA256 e27f0eabdaa7f4d26a25818b3be57a2b33cbe3d74f4bfb70d9614ead56bbb3ea
MD5 b7e58baa038ebdd8ccf3551d78acb88e
SHA1 ac4868a424f15e8be1e732cc5390ee81448b4551
SHA512 fff4668f13289246f5e0709e9fa9585e9233f69c14a9f27f3de7ee0eb0c3a0be73822c1c96562980cd4f4381ad0d9003a051a849046d73e35dca5e9b0ed6d999
SSDEEP 49152:5xfkunx2VexkuLPLbAvwkWa86/OOsi2yzN4JjLa9OzeQ1uJfuWWNTaSG6EWo1VCM:WXWWdsimvc14O9GHhy
TLSH
T1BE2608117A9B98EDC199C874834A4A731E21B4DB0B26B9FF41C446353FA9BB42F3D718
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateSearch.exe.Exe

Path C:\Users\Admin\Downloads\UpdateSearch.exe.Exe
Size 511KB
SHA256 798016bbcc5f38d76c959b7712c9d2c9800540c069dc32aa0b59c32b009bb15a
MD5 205bba65799a8984f1eb96b7cd945550
SHA1 7ae8f3713a519f452d3e44aff2b3d7cb7a1888dc
SHA512 8b766a59c75a0b63e864809c2d8d09d367f27bc3ed5c3c5e7123dc7c9d9514c6542c30a5a4cd3cf1e1412f5bfd2ed5a3c96e3c183434ca14804a8314e94a4f57
SSDEEP 12288:keDcVDaXo+/VKDbMBD7n79XTbQyIrMCaEdsCbQd073:bODgVKnMd779XI7M8QG
TLSH
T1A5B4126A71CDF7BAD0E6897A8D0DF2E06D39BC700D28486F759C5B1C897B0C6992C1D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 93KB
SHA256 effe104cd56fe963bafdaf00c97e19ff23f2684e27e2a6e435e7f25f333d7eb4
MD5 72abd1608ee19ff6430a984c3818e61a
SHA1 f51dfd7db5e7453c1d3227ba5666d266b2aa92f0
SHA512 d09848a953a38ffbff756796c4a31db083806425644bc10da92beaf3b4482a5d53dd2a1f7d0bfb6003ab5394573491d6e291f79067d942d0dbdd0fb9a37acf96
SSDEEP 1536:97qnkAQtSaoGo5n4iLG0/WM6T4HSaYqey/XxAyN9Hrnj/5vG4CGYN:MCSjGoLpWM6CB/XxAyPH//E/
TLSH
T169935B69B28CB772D0F159BC9E0DF2E57D297E301E29186BB59E1F1DDA7B1C2090C182
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 842B
SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
MD5 6f4adf207ef402d9ef40c6aa52ffd245
SHA1 4b05b495619c643f02e278dede8f5b1392555a57
SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
TLSH
T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2512-875-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2512-19-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2512-1520-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4548-8-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4784-17-0x0000000000400000-0x000000000042A000-memory.dmp

Download