47775e020d5bbb0eed87a1f438c616d519ecb2a4fcfb8bd780d6785a84965118

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 16:52

Target
2026-10-22_35e4e01b949e6760695965cd6a6abc1e_akira_glassworm_rusty-stealer.exe
Size 20.4MB
Sample261024-vdttbafc93
SHA256 47775e020d5bbb0eed87a1f438c616d519ecb2a4fcfb8bd780d6785a84965118
MD5 35e4e01b949e6760695965cd6a6abc1e
SHA1 2128896a4272f5660f767eaddf5a373d272a5baa
SHA512 29d0d7326f0e18480a8ed0a6db52d55996ad163e2b26d8eb7f83710ee60e316dc58f9a592a1bc93bfa7aed4913e035ee4292dc240671700ae8ad13f68ca22e01
SSDEEP 98304:5GBXDQax4hHr2aPw7wK+Xol72Y1VeEYAR8ZYZ2SiWeDjlKXkfvd7ryJh692A+5fJ:QBchXPnolTz2QIvdKJh692A8v
TLSH
T188270716B77960D9D1BAC07882839B22B931749D07397BF789C1466A2F24FF8AD3D350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5464 wrote to memory of 2592	5464	2026-10-22_35e4e01b949e6760695965cd6a6abc1e_akira_glassworm_rusty-stealer.exe	90
PID 5464 wrote to memory of 2508	5464	2026-10-22_35e4e01b949e6760695965cd6a6abc1e_akira_glassworm_rusty-stealer.exe	92
PID 5464 wrote to memory of 4824	5464	2026-10-22_35e4e01b949e6760695965cd6a6abc1e_akira_glassworm_rusty-stealer.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-10-22_35e4e01b949e6760695965cd6a6abc1e_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_35e4e01b949e6760695965cd6a6abc1e_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5464
- C:\Windows\system32\cmd.exe
  "cmd.exe"
  2⤵
  PID:2592
- C:\Windows\system32\cmd.exe
  "cmd.exe"
  2⤵
  PID:2508
- C:\Windows\system32\cmd.exe
  "cmd.exe"
  2⤵
  PID:4824

.tmpCptBTD

Path C:\Users\Admin\AppData\Local\Temp\.tmpCptBTD
Size 1.4MB
SHA256 5596d05b12f12e268d4d9418b201f81533c985c09d28f2b91c2b013174e1be48
MD5 327d2131f826c9c6f323d8a919d06354
SHA1 8815f0ad1d3231f3af571be800c9979358fd56b7
SHA512 e0bb1a2bc445c12f1c752b5aca544be4ab860479f5f4ba57dbb016494625308e19179a91c3c0a883747284e97debab52e3ec2ff88410bf750c61060f1e2a70d0
SSDEEP 192:znnnknnnknnnknnnknnnknnnknnnknnnknnnknnnknnnknnnknnnknnnknnnknn8:n
TLSH
T128659564E6614E7E1F176ACC908E58DE6A4FCEF301C9002517F146C1C610694840ED1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.tmpLa0hEb

Path C:\Users\Admin\AppData\Local\Temp\.tmpLa0hEb
Size 10B
SHA256 33f96bab0c210fb349531d3a919d824e9142b38ba41cec45394476e2c85ebff0
MD5 a65efe0e8d64068a6a456b7ad888cbd6
SHA1 2922f659d947233bccb830041ed4198aed2e2e87
SHA512 5755bd79984fd23202505cfc3d8861f728623fa5e9c02112897c3a3ab57412f29e70da248460603ccb1a10f80737d4913a127da65a43d597375b19be06696fe8
MD5 SHA1 SHA512

Submit Download

.tmpYzEZP2

Path C:\Users\Admin\AppData\Local\Temp\.tmpYzEZP2
Size 10B
SHA256 247ccb28a1f57cd0f56961a01b65a0d889fc5273ea676fad1be903e6bcf3c379
MD5 b3d83d8e809e349fe1b13f4b3208bf00
SHA1 659bce431a1df68791119cb793e121452127ccd0
SHA512 f306a0158f7bfffa905607ca5c7d5d9e65c0d9c88d2a0be2f14f4257f7b6e4910f3d873d14502a0ff81298fcca58d98c4713d7db744243caa9faf8297aee1484
MD5 SHA1 SHA512

Submit Download

history.txt

Path C:\Users\Admin\AppData\Local\Temp\.tmpjk4JEe\Outils\history.txt
Size 10B
SHA256 56c8399b9fcf04a31611b43aa9d97e2c86a5a90810437aa19c985e8526afed7b
MD5 a76ac9f8da0f85582ebc13a1d12a28c0
SHA1 88d5561060adf511dbfece57ee8b0171073219f4
SHA512 5fec9cefc91061a3185d85a055f25253810b8ff503bf1ebcaf3d12f51e9d2ccc32b8aadb39270c26f175726fc224356bdd69d7c5d2fb2347780e4fa77d957583
MD5 SHA1 SHA512

Submit Download

history.txt

Path C:\Users\Admin\AppData\Local\Temp\.tmpjk4JEe\Outils\history.txt
Size 20B
SHA256 ee9142520a8bc52edce14d25d27f6a046072f79c2c7e47eb22703f57a6057891
MD5 bcec991197563640aafc9c0686652619
SHA1 b22c96d325ddf75e6e16774a861015b2adcfc06f
SHA512 403f2ff5abf20eccec460c91650ba78aeb3831540806892485e1962a28e650ea8fc37439642ae292050fb48ea5123c54fc79ee6334a19849eb114944a4620d8c
MD5 SHA1 SHA512

Submit Download