Analysis
- max time kernel
148s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/10/2026, 11:16
General
- Target 2026-10-22_618801eebf0c283747754e8a875b16da_akira_glassworm_icedid_megazord_rusty-stealer_ryuk.exe
- Size 4.2MB
- Sample261024-ndc28seg97
- SHA256 d2a4c3fd5d1f486dbe069fc157996ee41f952b659ee9b9ed8332f5da3b32f2db
Malware Config
Signatures
- Looks up external IP address via web service 1 TTPs 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Uses WMI to collect hardware manufacturer information 2 TTPs 1 IoCs
Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Using powershell.exe command.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_618801eebf0c283747754e8a875b16da_akira_glassworm_icedid_megazord_rusty-stealer_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_618801eebf0c283747754e8a875b16da_akira_glassworm_icedid_megazord_rusty-stealer_ryuk.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -NoProfile -NonInteractive -Command "$c = Get-CimInstance Win32_Processor | Select-Object -First 1; $ghz = [math]::Round($c.MaxClockSpeed / 1000.0, 2); '{0} | {1}C/{2}T @ {3}GHz' -f $c.Name.Trim(), $c.NumberOfCores, $c.NumberOfLogicalProcessors, $ghz"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -NoProfile -NonInteractive -Command "$os = Get-CimInstance Win32_OperatingSystem; $total = [math]::Round($os.TotalVisibleMemorySize / 1048576.0, 1); $free = [math]::Round($os.FreePhysicalMemory / 1048576.0, 1); $used = [math]::Round($total - $free, 1); '{0} GB total ({1} GB used)' -f $total, $used"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -NoProfile -NonInteractive -Command "Get-CimInstance Win32_VideoController | Where-Object { $_.Name -notmatch 'Parsec|TeamViewer|VirtualBox|VMware|Microsoft Basic|Remote Desktop|RDP|Indirect|Virtual|Basic Render|Citrix|Moonlight|IDD' } | Sort-Object -Property AdapterRAM -Descending | Select-Object -First 1 | ForEach-Object { $vram = if ($_.AdapterRAM -gt 104857600) { ' ({0} GB VRAM)' -f [math]::Round($_.AdapterRAM / 1073741824.0, 1) } else { '' }; $_.Name.Trim() + $vram }"2⤵
- Uses WMI to collect hardware manufacturer information
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -NoProfile -NonInteractive -Command "(Get-NetIPAddress -AddressFamily IPv4 | Where-Object {$_.InterfaceAlias -notlike '*Loopback*'} | Select-Object -First 1).IPAddress"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -NoProfile -NonInteractive -Command "[math]::Round((Get-CimInstance Win32_LogicalDisk -Filter \"DeviceID='C:'\").Size / 1GB, 0)"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_wgda21qf.15z.psm1
diagerr.etl
memory/4352-25-0x00007FFC0A7C0000-0x00007FFC0B164000-memory.dmp
memory/4352-28-0x00007FFC0A7C0000-0x00007FFC0B164000-memory.dmp
memory/4352-14-0x00007FFC0A7C0000-0x00007FFC0B164000-memory.dmp
memory/4352-15-0x00007FFC0A7C0000-0x00007FFC0B164000-memory.dmp
memory/4352-16-0x00007FFC0A7C0000-0x00007FFC0B164000-memory.dmp
memory/4352-19-0x00000264ED050000-0x00000264ED06E000-memory.dmp
memory/4352-20-0x00000264ED340000-0x00000264ED3F2000-memory.dmp
memory/4352-12-0x00007FFC0A7C0000-0x00007FFC0B164000-memory.dmp
memory/4352-21-0x00000264ED070000-0x00000264ED07A000-memory.dmp
memory/4352-23-0x00000264ED0D0000-0x00000264ED0F4000-memory.dmp
memory/4352-22-0x00000264ED0D0000-0x00000264ED0FA000-memory.dmp
memory/4352-24-0x00007FFC0A7C0000-0x00007FFC0B164000-memory.dmp
memory/4352-11-0x00007FFC0A7C0000-0x00007FFC0B164000-memory.dmp
memory/4352-26-0x00007FFC0A7C0000-0x00007FFC0B164000-memory.dmp
memory/4352-27-0x00007FFC0A7C0000-0x00007FFC0B164000-memory.dmp
memory/4352-13-0x00007FFC0A7C0000-0x00007FFC0B164000-memory.dmp
memory/4352-30-0x00007FFC0A7C0000-0x00007FFC0B164000-memory.dmp
memory/4352-31-0x00007FFC0A7C0000-0x00007FFC0B164000-memory.dmp
memory/4352-67-0x00007FFC0A7C0000-0x00007FFC0B164000-memory.dmp
memory/4352-10-0x00007FFC0A7C0000-0x00007FFC0B164000-memory.dmp
memory/4352-4-0x00007FFC0A94F000-0x00007FFC0A950000-memory.dmp
memory/4352-8-0x00007FFC0A7C0000-0x00007FFC0B164000-memory.dmp
memory/4352-7-0x00000264ECFB0000-0x00000264ECFD2000-memory.dmp
memory/5176-42-0x00007FFC0A7C0000-0x00007FFC0B164000-memory.dmp
memory/5176-43-0x00007FFC0A7C0000-0x00007FFC0B164000-memory.dmp
memory/5176-40-0x00007FFC0A7C0000-0x00007FFC0B164000-memory.dmp
memory/5176-37-0x00007FFC0A7C0000-0x00007FFC0B164000-memory.dmp
memory/5176-36-0x00007FFC0A7C0000-0x00007FFC0B164000-memory.dmp
memory/5176-32-0x00007FFC0A7C0000-0x00007FFC0B164000-memory.dmp
memory/5316-55-0x000001E677990000-0x000001E6779AE000-memory.dmp