5ebb3230b518309b3edfb72abcd3935739eea4614afdac05da26d7dc3568a87b

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 17:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-05_a4ae0bf2eb5e806780d9b1017795d712_akira_glassworm_rusty-stealer.exe
Size 5.1MB
Sample261006-wh898set3k
SHA256 5ebb3230b518309b3edfb72abcd3935739eea4614afdac05da26d7dc3568a87b
MD5 a4ae0bf2eb5e806780d9b1017795d712
SHA1 171f985c8bca22523f21da801e3b7d81cf9e2e96
SHA512 e4c230a439ed19fc948e6b1930371a9c390462c991c875cea3cb4f3de5ad79e67a34846bc28d773f1ac5430180f0314ec74aefacdf2f556daad65d640b09a15b
SSDEEP 98304:7Jr/H5GhOXUTZeRuwvL0GYdd2+r+2HXGSL:J5GhOXUTA7vL0GYiY53xL
TLSH
T192468C43F26251E8C0AAC5B4934AA232F6753C8D472579EF4BD05B312E65FD06B3DB0A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
2152	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
5756	9QbsCImh.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	2026-10-05_a4ae0bf2eb5e806780d9b1017795d712_akira_glassworm_rusty-stealer.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4132	2026-10-05_a4ae0bf2eb5e806780d9b1017795d712_akira_glassworm_rusty-stealer.exe
Token: SeDebugPrivilege	5756	9QbsCImh.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 2152	4132	2026-10-05_a4ae0bf2eb5e806780d9b1017795d712_akira_glassworm_rusty-stealer.exe	90
PID 4132 wrote to memory of 5756	4132	2026-10-05_a4ae0bf2eb5e806780d9b1017795d712_akira_glassworm_rusty-stealer.exe	91
PID 5756 wrote to memory of 4220	5756	9QbsCImh.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-10-05_a4ae0bf2eb5e806780d9b1017795d712_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-05_a4ae0bf2eb5e806780d9b1017795d712_akira_glassworm_rusty-stealer.exe"
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  - Deletes itself
  PID:2152
- C:\Users\Admin\Downloads\9QbsCImh.exe
  "C:\Users\Admin\Downloads\9QbsCImh.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9QbsCImh.exe

Path C:\Users\Admin\Downloads\9QbsCImh.exe
Size 5.5MB
SHA256 9d1b7f1b156f4d8c0bf434c17b5d47bf6231560514e8eef67a6f97859255b25d
MD5 e4cb0f608c571a9707bb34d0ca2e7193
SHA1 95d64e1ec89d9abcdb6cfa9d25ef012b3a199bd6
SHA512 24a3fd1dc8c182614c0cedcfa7b43a472b0f61d66bb936afeb5994cf227a40ce38a488848b181df71cb353f8fc94dd08478289c02435b2c0e74ddbafb8a2a33e
SSDEEP 98304:oo7J1mhOXdJKCPuThYGO30GYRhkcU+XbGGK2MiRJ3v:l1mhOXdJtKhYREGYoCbGCz
TLSH
T11A469C03F26292E8C06AC5B4535AA232F7313C8D472579EF5BD05B212E65FD06B3DB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PZxtUZp74Dsy.7z

Path C:\Users\Admin\Downloads\PZxtUZp74Dsy.7z
Size 2.7MB
SHA256 950dac941c103acfb5137d7ee1e9ea58a597b20fa02855622d687e8c1111106d
MD5 812633595b0c74451c9f0b37da1dfc46
SHA1 e0621ac1bf64dd81c0c4496b8ef1b00ae8a00340
SHA512 b63617ac9b9770878a0a04e83e50d8cff715df5772e912e91efb88f966f96eabec2f3d1ba557834b938e48f3d881809be660c044dfca479fb68fdb8218e036ba
SSDEEP 49152:IaI5VGisEjkUDnRDpZJV3xXwSXgBTJ+8XF672w8mq0RJltHjSNH4R8:IaIrjpxTXg5k8a8mlD04K
TLSH
T131D533188D9CD02BA49C783CE2E6F1D1E0720A663B79B7136A6EF207C59C6D817D3E54
MD5 SHA1 SHA512 SSDEEP TLSH