7665d952613d2a14c71453e9918cbd79b61a5f825854ded437a33448e1046456

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 00:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-25_7258ae0dc7d11edcdd370448547f379e_akira_glassworm.exe
Size 4.9MB
Sample261027-afc85axt7j
SHA256 7665d952613d2a14c71453e9918cbd79b61a5f825854ded437a33448e1046456
MD5 7258ae0dc7d11edcdd370448547f379e
SHA1 0332f4dbef4c42c70446b24f5a9f7c720c5ce543
SHA512 a9fb15d0ec85c72c9c8e8e921500188054fa3737672789fe1f511f13fe1a9bd6180ea5eba54d74a2541aeda6a58ee9d22fcd322ef093bb70c5fe7dc135a3b37f
SSDEEP 49152:1PJFlUJZq68qLeMtNj67LPsdcM9LraWFsSECwspAUNtmbHywXx9wlUuq8Pv0K2k9:k/4q17D
TLSH
T12D36D72BA77960D9C0BFC07892839B22BD6134D9473977E7858092691F64EF8BD3C364
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5968	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 5020	3312	2026-10-25_7258ae0dc7d11edcdd370448547f379e_akira_glassworm.exe	90
PID 3312 wrote to memory of 5968	3312	2026-10-25_7258ae0dc7d11edcdd370448547f379e_akira_glassworm.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-10-25_7258ae0dc7d11edcdd370448547f379e_akira_glassworm.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-25_7258ae0dc7d11edcdd370448547f379e_akira_glassworm.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Windows\system32\conhost.exe
  \\?\C:\Windows\system32\conhost.exe --headless --width 120 --height 30 --signal 0x1f4 --server 0x1ec
  2⤵
  PID:5020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /C "echo xmr-host-e2e"
  2⤵
  - Executes a command shell one-liner
  PID:5968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

index.jsonl

Path C:\Users\amgryn\dsh workspace\xiaomaorou\rust\xmr-process-host\target\tmp\xmr-host-e2e-3312-1697971a-d047-4d6b-9f5c-37e81d7b2790\8cd10214-f41c-460c-9f0c-52f1c6484a66\index.jsonl
Size 264B
SHA256 47b45847a603465c754aa66c6d21d5b50dfd65085e0621f5268b62d831c15b4e
MD5 4e75f3263b4d65d3ad6edcc15c102e81
SHA1 bb70e57528aee13929f8eb398a839f812b4d69f8
SHA512 25a3916b71b3a63d0997319c30ef61a4f42415f819e5e5c094a6e6a3792abc0fcbc8a8b7351a6342791ed1bc549f7cbfe1531f4b15f79d753bb72df949544f2e
TLSH
T11FD0423A88100CB66880DD1E9F55CDBF1DB412917A658882F76F6B18576A43C6AC7584
MD5 SHA1 SHA512 TLSH

Submit Download

meta.json

Path C:\Users\amgryn\dsh workspace\xiaomaorou\rust\xmr-process-host\target\tmp\xmr-host-e2e-3312-1697971a-d047-4d6b-9f5c-37e81d7b2790\8cd10214-f41c-460c-9f0c-52f1c6484a66\meta.json
Size 184B
SHA256 184f63988e87ea836c9aba23713619e51ded2a467abd258db0b0e28ef63c92e9
MD5 021f5fcef9d1fa65a5bedb9cd42f01ef
SHA1 d9049034ed82a1eb9a63979d1d61702d86bb0913
SHA512 3f23b202fb0556be407cef604906fcb2c50ff6c237e004adb951432653c322011512246e975674fbb3c138aa33d94bb4651a5b6a1083f10d754be67d0527ef0d
TLSH
T1D2C01222D8102DF676E8693AC921C72257E4AF043576389679DB8025561EB3901E0A09
MD5 SHA1 SHA512 TLSH

Submit Download

meta.json

Path C:\Users\amgryn\dsh workspace\xiaomaorou\rust\xmr-process-host\target\tmp\xmr-host-e2e-3312-1697971a-d047-4d6b-9f5c-37e81d7b2790\8cd10214-f41c-460c-9f0c-52f1c6484a66\meta.json
Size 222B
SHA256 88ffb902a366e9fea7e89b8158aace5838afd3858576de2538e3c1f03fc700ca
MD5 710fa4f85fdc293af724d0777aaec8fb
SHA1 2f8468de76a197228c07eda8d0e4a1f03ef37ab7
SHA512 694a15b71e142e1c4e899cb7fb407ea43cd3c52e73a789aeadf1c4382626df8fe51b674abf3f30114d03a515f4edc781c2b9a2dcd4306d97699377ccd55f0f9f
TLSH
T1DCD0C721D4203DF665E4A57F8565856257B4AD482696309C71DBC405561DB2A02E090A
MD5 SHA1 SHA512 TLSH

Submit Download

output.vt.zst

Path C:\Users\amgryn\dsh workspace\xiaomaorou\rust\xmr-process-host\target\tmp\xmr-host-e2e-3312-1697971a-d047-4d6b-9f5c-37e81d7b2790\8cd10214-f41c-460c-9f0c-52f1c6484a66\output.vt.zst
Size 139B
SHA256 5f580f6bc846fea36521816dc6d577dd6bb3272883004022de5f2f4cbde0e74d
MD5 5c65f92f533bb98eb556bf42feb43d0b
SHA1 c3d3c9dae85e9fe1a086ad113ad3d9ae2e776517
SHA512 fd36016d26cbc188993d40f57fde6fd064eb74ee3913c3b25d9ca2872a18448f14479962f3a8222e69cd1303e1e984a2f539e66fa9fa84ba52cda9deb15269ee
TLSH
T172C02BEBF301218000DF0B10985C34DA103121C70325803128D404A090191314EF08AC
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads