7665d952613d2a14c71453e9918cbd79b61a5f825854ded437a33448e1046456

Analysis

max time kernel
149s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 00:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-25_7258ae0dc7d11edcdd370448547f379e_akira_glassworm.exe
Size 4.9MB
Sample261027-afc85axt7j
SHA256 7665d952613d2a14c71453e9918cbd79b61a5f825854ded437a33448e1046456
MD5 7258ae0dc7d11edcdd370448547f379e
SHA1 0332f4dbef4c42c70446b24f5a9f7c720c5ce543
SHA512 a9fb15d0ec85c72c9c8e8e921500188054fa3737672789fe1f511f13fe1a9bd6180ea5eba54d74a2541aeda6a58ee9d22fcd322ef093bb70c5fe7dc135a3b37f
SSDEEP 49152:1PJFlUJZq68qLeMtNj67LPsdcM9LraWFsSECwspAUNtmbHywXx9wlUuq8Pv0K2k9:k/4q17D
TLSH
T12D36D72BA77960D9C0BFC07892839B22BD6134D9473977E7858092691F64EF8BD3C364
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2988	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 4160	2904	2026-10-25_7258ae0dc7d11edcdd370448547f379e_akira_glassworm.exe	85
PID 2904 wrote to memory of 2988	2904	2026-10-25_7258ae0dc7d11edcdd370448547f379e_akira_glassworm.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-10-25_7258ae0dc7d11edcdd370448547f379e_akira_glassworm.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-25_7258ae0dc7d11edcdd370448547f379e_akira_glassworm.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\system32\conhost.exe
  \\?\C:\Windows\system32\conhost.exe --headless --width 120 --height 30 --signal 0x198 --server 0x194
  2⤵
  PID:4160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /C "echo xmr-host-e2e"
  2⤵
  - Executes a command shell one-liner
  PID:2988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

index.jsonl

Path C:\Users\amgryn\dsh workspace\xiaomaorou\rust\xmr-process-host\target\tmp\xmr-host-e2e-2904-0e47186f-7525-4fa3-a1f0-0d73e2a9324f\21fb389e-35f7-4e29-b64e-c67cae8d7199\index.jsonl
Size 87B
SHA256 27893757da9206c8c6d4b5ac0825994371fc79bff2c68d9762fb6d8628eaaa9d
MD5 77ef241ecb31d2d82a4bb80e51fd4d31
SHA1 078bd617793394ec140c74ec62380654a5f3c321
SHA512 5905dc3a32645f4de78db787d4809550c739eabb3dcd70346a25dc9853ca22a9d86eff7affc3324a0d4f745fad6589df5c0ee4e33d021dbcc9ce54a82365ee5a
TLSH
T1EFB0123658040CF13640CC1D4A0245FF1CF222433A100481F13F3358021743817C7040
MD5 SHA1 SHA512 TLSH

Submit Download

meta.json

Path C:\Users\amgryn\dsh workspace\xiaomaorou\rust\xmr-process-host\target\tmp\xmr-host-e2e-2904-0e47186f-7525-4fa3-a1f0-0d73e2a9324f\21fb389e-35f7-4e29-b64e-c67cae8d7199\meta.json
Size 184B
SHA256 2ec5e22da50d77692c1eee4689aaec666616ba08d267ae6614e36b82a525d631
MD5 cfa365e745119d4c3b8d36e5e3f857bc
SHA1 6162113ba23c257442d44dc00ac71310601607dd
SHA512 36dab23d165c597091ae2d9922ae88745ec05a1a64ac576e0798f5331b29f75fca802e88cb5836512a45baeee8053c34ed29bc6cf7b4628e65b4b0e4505baa5e
TLSH
T1BBC01231DC841CF231D55C364531836667D0AF04253374CA7ACBC156521E53909F1A45
MD5 SHA1 SHA512 TLSH

Submit Download

meta.json

Path C:\Users\amgryn\dsh workspace\xiaomaorou\rust\xmr-process-host\target\tmp\xmr-host-e2e-2904-0e47186f-7525-4fa3-a1f0-0d73e2a9324f\21fb389e-35f7-4e29-b64e-c67cae8d7199\meta.json
Size 220B
SHA256 84a2a4a8a34e003706b8ad986d5c9b252305834d2946becb4c8b49b49dec2a27
MD5 95e8e24a65acd3b9f16fa5d95009386a
SHA1 7401745244dfbfa311b8924ab20cd7d0f61e2545
SHA512 913685b2c15261e89caf596472eee42c3de80e2332e6e9a16efc4f3e363e1336d2a180ad0b697aa4f7f901891d359485fb5ef35be6eb6d8efd06484458e3aa39
TLSH
T1CBD0C730DC541CF315D15477553196669AA0FE042A5370DC76CBC646431D52A17F1A46
MD5 SHA1 SHA512 TLSH

Submit Download

output.vt.zst

Path C:\Users\amgryn\dsh workspace\xiaomaorou\rust\xmr-process-host\target\tmp\xmr-host-e2e-2904-0e47186f-7525-4fa3-a1f0-0d73e2a9324f\21fb389e-35f7-4e29-b64e-c67cae8d7199\output.vt.zst
Size 75B
SHA256 f761acf4768459e1765abcef336ad031eca0aa71be4a2e86ddad4664ed9ec17d
MD5 b3f7aae31981a6d78004c354e343ade6
SHA1 65ac2bd03ef5010aaeb4b56ac8b255c7f247600d
SHA512 af40942f6123a3c7bd546d569089a5bdfcaeb0a2d87902a5fe5679b23b7794a99e933208139780a4afadffcb3e6c7a7bb59f1c0b7d85c4ccabc49343d6ac1a7b
TLSH
T100A02282E00C20A888E80AB2B0AB000CB023B083A300083302E20080E8BE30208A3FBC
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads