636772caab9fcb9ba4c4e839fb169768462d992a07ff32ad7cf2055170f829dc

Resubmissions

27/10/2026, 09:10

261027-k49mcasyct10

18/08/2026, 02:32

260818-c1qq3avand8

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 09:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_1863621788b2d33bd5b4a87e62aab997_akira_glassworm_icedid_megazord_rusty-stealer_ryuk.exe
Size 3.8MB
Sample261027-k49mcasyct
SHA256 636772caab9fcb9ba4c4e839fb169768462d992a07ff32ad7cf2055170f829dc
MD5 1863621788b2d33bd5b4a87e62aab997
SHA1 3c2c52b1431ecf41cfdfca236134dc057bd999ab
SHA512 dc8e26155801f7a7438aa9fbb4ce7ebc12c20609c4e4598ad953a1a46228e39f3234ba58f3c707161d105af198ba7262f0962145279a5b1d8311018ad833e08c
SSDEEP 49152:V4zjD8G4Q7B4FGgLRqZ1lMYgInYo2VKzSVvwGtulnWjiRnSJgLw15UlO4TEEFYPD:/W3lQ6rSuA2SJ+w1MTWPN+Y
TLSH
T11D068D03F69580F9C05DC079874B9632FA32B8890635B2EF6BD45B213E66F906F1E719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3988	powershell.exe
3988	powershell.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\installer = "\"\\\\?\\C:\\Users\\Admin\\AppData\\Local\\Packages\\Extensions\\2974AEB54CF180060A07E97A18011C03B816F82E59FF5F9E0396B9B2DDCCEA7C-agent\\installer.exe\""	2026-08-18_1863621788b2d33bd5b4a87e62aab997_akira_glassworm_icedid_megazord_rusty-stealer_ryuk.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-08-18_1863621788b2d33bd5b4a87e62aab997_akira_glassworm_icedid_megazord_rusty-stealer_ryuk.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2380	2026-08-18_1863621788b2d33bd5b4a87e62aab997_akira_glassworm_icedid_megazord_rusty-stealer_ryuk.exe
2380	2026-08-18_1863621788b2d33bd5b4a87e62aab997_akira_glassworm_icedid_megazord_rusty-stealer_ryuk.exe
2380	2026-08-18_1863621788b2d33bd5b4a87e62aab997_akira_glassworm_icedid_megazord_rusty-stealer_ryuk.exe
2380	2026-08-18_1863621788b2d33bd5b4a87e62aab997_akira_glassworm_icedid_megazord_rusty-stealer_ryuk.exe
2380	2026-08-18_1863621788b2d33bd5b4a87e62aab997_akira_glassworm_icedid_megazord_rusty-stealer_ryuk.exe
2380	2026-08-18_1863621788b2d33bd5b4a87e62aab997_akira_glassworm_icedid_megazord_rusty-stealer_ryuk.exe
3988	powershell.exe
3988	powershell.exe
2380	2026-08-18_1863621788b2d33bd5b4a87e62aab997_akira_glassworm_icedid_megazord_rusty-stealer_ryuk.exe
2380	2026-08-18_1863621788b2d33bd5b4a87e62aab997_akira_glassworm_icedid_megazord_rusty-stealer_ryuk.exe
2380	2026-08-18_1863621788b2d33bd5b4a87e62aab997_akira_glassworm_icedid_megazord_rusty-stealer_ryuk.exe
2380	2026-08-18_1863621788b2d33bd5b4a87e62aab997_akira_glassworm_icedid_megazord_rusty-stealer_ryuk.exe
2380	2026-08-18_1863621788b2d33bd5b4a87e62aab997_akira_glassworm_icedid_megazord_rusty-stealer_ryuk.exe
2380	2026-08-18_1863621788b2d33bd5b4a87e62aab997_akira_glassworm_icedid_megazord_rusty-stealer_ryuk.exe
2380	2026-08-18_1863621788b2d33bd5b4a87e62aab997_akira_glassworm_icedid_megazord_rusty-stealer_ryuk.exe
2380	2026-08-18_1863621788b2d33bd5b4a87e62aab997_akira_glassworm_icedid_megazord_rusty-stealer_ryuk.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	3988	powershell.exe
Token: SeIncreaseQuotaPrivilege	3988	powershell.exe
Token: SeSecurityPrivilege	3988	powershell.exe
Token: SeTakeOwnershipPrivilege	3988	powershell.exe
Token: SeLoadDriverPrivilege	3988	powershell.exe
Token: SeSystemProfilePrivilege	3988	powershell.exe
Token: SeSystemtimePrivilege	3988	powershell.exe
Token: SeProfSingleProcessPrivilege	3988	powershell.exe
Token: SeIncBasePriorityPrivilege	3988	powershell.exe
Token: SeCreatePagefilePrivilege	3988	powershell.exe
Token: SeBackupPrivilege	3988	powershell.exe
Token: SeRestorePrivilege	3988	powershell.exe
Token: SeShutdownPrivilege	3988	powershell.exe
Token: SeDebugPrivilege	3988	powershell.exe
Token: SeSystemEnvironmentPrivilege	3988	powershell.exe
Token: SeRemoteShutdownPrivilege	3988	powershell.exe
Token: SeUndockPrivilege	3988	powershell.exe
Token: SeManageVolumePrivilege	3988	powershell.exe
Token: 33	3988	powershell.exe
Token: 34	3988	powershell.exe
Token: 35	3988	powershell.exe
Token: 36	3988	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 1056	2380	2026-08-18_1863621788b2d33bd5b4a87e62aab997_akira_glassworm_icedid_megazord_rusty-stealer_ryuk.exe	84
PID 2380 wrote to memory of 3988	2380	2026-08-18_1863621788b2d33bd5b4a87e62aab997_akira_glassworm_icedid_megazord_rusty-stealer_ryuk.exe	88
PID 2380 wrote to memory of 3384	2380	2026-08-18_1863621788b2d33bd5b4a87e62aab997_akira_glassworm_icedid_megazord_rusty-stealer_ryuk.exe	95
PID 2380 wrote to memory of 3384	2380	2026-08-18_1863621788b2d33bd5b4a87e62aab997_akira_glassworm_icedid_megazord_rusty-stealer_ryuk.exe	95
PID 2380 wrote to memory of 1728	2380	2026-08-18_1863621788b2d33bd5b4a87e62aab997_akira_glassworm_icedid_megazord_rusty-stealer_ryuk.exe	97
PID 2380 wrote to memory of 1728	2380	2026-08-18_1863621788b2d33bd5b4a87e62aab997_akira_glassworm_icedid_megazord_rusty-stealer_ryuk.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-08-18_1863621788b2d33bd5b4a87e62aab997_akira_glassworm_icedid_megazord_rusty-stealer_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_1863621788b2d33bd5b4a87e62aab997_akira_glassworm_icedid_megazord_rusty-stealer_ryuk.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\system32\getmac.exe
  "getmac" /fo csv /nh
  2⤵
  PID:1056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | Select-Object -ExpandProperty displayName"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google/Chrome/Application/chrome.exe"
  2⤵
  PID:3384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google/Chrome/Application/chrome.exe"
  2⤵
  PID:1728

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3240

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2428

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1632

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 18KB
SHA256 b83e825d5a288a2fbe647d6f49b4674ee2c92cca4556395d866f7ffd8254f74b
MD5 335f37edef3b3cb486a60d0088c2d736
SHA1 d5c202d17ae017b9a97a9a8ba06709840c3cca55
SHA512 5561459978fd5c8c8178a82bc8a3db8a852238038f09bc912f550bc45429c6f7b5f85ed3725735fbb056b922bf67d10d65e67121e26681b5d8517c506010de2f
SSDEEP 384:TNj/O7KxkXqKf/pUZNCgVLH2Hfgsl5p7pLuLceSeVkekXOD/q+ErU3v7HGRSRTQ6:TN/O7KxkXqKf/pUZNCgVLH2Hfgsvp7pu
TLSH
T1FA82F7677C489A3B0F94CA8CDC277B4FECB9014B65E9896447FB582903D4BDB11062EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 25KB
SHA256 eebe46532af76a20663a102190896671c47e1f8c19f759ccbba07fc4e6e28a2f
MD5 aae2b984250daad3974d3b2ecf35ace9
SHA1 cfd2894096692b79dfaa66a6cdad595e4a003122
SHA512 978cd0280a0cefc99965054bb18263f9d3beae07c3fd8cea9cec53f66b936cccfdf7fca0ff4a4bb695410fc2df45bae6853f17ce05c5701cf88805cdabb7f7d4
SSDEEP 768:UvM4Wlx8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPLlUsrUWgmR:UU4Wlxu1jaaLCWnR
TLSH
T1D1C20B3B740DCB7E5FC00E9DDD6A6F962E9802D76AA8494047FE944C02C77ED51264CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

background.ts-D6ogNSgd.js

Path C:\Users\Admin\AppData\Local\Packages\Extensions\2974AEB54CF180060A07E97A18011C03B816F82E59FF5F9E0396B9B2DDCCEA7C\e0\assets\background.ts-D6ogNSgd.js
Size 19KB
SHA256 51af480dc4dcab3bc14c51642954f4c7ea44814031d187fc6812f3b1911e0df0
MD5 4aa11528f17eca7d1b96cd98383962f1
SHA1 e2a68282d1e94ea443534e66bd965d8f1cb12aff
SHA512 9c1616cc2edccf0a390eb7ca71d9cf2fd0a5f9a09c5f24b9dff2fce0275c93320a0eab0213d51980e621a901bb2b64f88e75c670bdb92d2b41417ba500666c1e
SSDEEP 384:ShGacWt1UArM8iwIVP4svuUtCGRhxdno4o/ZDE/v6fqvTprRqA660aOvBMI4M2nC:SEacWt17rM8iwCP4svuUtCGRhnno4o/5
TLSH
T13692FB59317A2070E6E535F4A0774241B239CB347409C0A2B13E8E797D6ED46997EFBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.ts-B6XGI__y.js

Path C:\Users\Admin\AppData\Local\Packages\Extensions\2974AEB54CF180060A07E97A18011C03B816F82E59FF5F9E0396B9B2DDCCEA7C\e0\assets\content.ts-B6XGI__y.js
Size 2KB
SHA256 06c52cf8a22691d35691646d559f031c8dcb6b7410ecac03296e8064f0ff6546
MD5 20193f27c2a43683d792558e0b4807c2
SHA1 e25325fd1d7b5a9049c8f9f43eea0ee615a340f1
SHA512 9295e628d924ef67d0c091486d625aacd554e8ac04fc7a122387fe0fb45707afdae5e22f135a4ee45f9ae95e02968dece3f729ed7ec4cd0945a6d3ee64a07bf9
TLSH
T1814154C4B3B5A87021F65DB6A1B36140F6994686F02E4041502A4EFA3DB5CCB8B7379E
MD5 SHA1 SHA512 TLSH

Submit Download

icon.png

Path C:\Users\Admin\AppData\Local\Packages\Extensions\2974AEB54CF180060A07E97A18011C03B816F82E59FF5F9E0396B9B2DDCCEA7C\e0\icon.png
Size 158B
SHA256 bc7d2196729fdf734a19cb57f479256cf545fbe896ee0722712928810425a351
MD5 ddf750fd2569862fbc571cf73afd1687
SHA1 b136b37bb4b70599e141f8561ff303b592f95743
SHA512 bde06725d50c11681f638410f1c5285a23fe2d7ea74e54b25a2ce4957d2c1745cbc3504ed53eb8004d31a1b9a1225745c50fbe4c29273a9fa98214ecb598f51e
TLSH
T152C08CFFD7904C33E4680421017C68238526197C5A89E112D09248A43932448CAE9AAB
MD5 SHA1 SHA512 TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Packages\Extensions\2974AEB54CF180060A07E97A18011C03B816F82E59FF5F9E0396B9B2DDCCEA7C\e0\icons\128.png
Size 6KB
SHA256 14770473282440dc072ab9e40f297a82645f9e07b97641c507d2eab264175b43
MD5 12418c9ab11ed9ee088f4a9dbdb578c3
SHA1 66d335dd5b36b185639e6c7d403466a94b15001f
SHA512 0f7fc0dc9c9724e39f6203affe70a487bf85b0f0fdd468cf236cc3ff659692190bf43ed60cd2c89b6f616ab6090a4840a6eab4e5611a7c3adaeee0c687f6ac24
SSDEEP 192:sP9N6BlbaMuTz2ezeDLO9PDhq8TdZrkrZpmRvJPCXYwm9EbAhb4:ECbaMu+bOZDhEsvcm9EkR4
TLSH
T153E18D2ACC423BB87B5E5A5560D9370D8C62A70EA126EF235DBB3E907CB2A2155B8050
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

16.png

Path C:\Users\Admin\AppData\Local\Packages\Extensions\2974AEB54CF180060A07E97A18011C03B816F82E59FF5F9E0396B9B2DDCCEA7C\e0\icons\16.png
Size 654B
SHA256 e6b384718ad9f1e793e4de4400391fc96be67aec9cdeca4a408e8ecec7ee6fcb
MD5 4222c9bc3edff30070ad302f873ab597
SHA1 2858ba5545e43723dbb2bccf371f72445fc6abf3
SHA512 d7ad3a1565aaf31cddde96b9c3bb09318f6872abc8dfb081d6ebbd6aae8579a7d57e07cf2f017cb3bafa9d168ee4773bb1b5398f36b977d568693dcc55f2883a
TLSH
T177F0835277B6007E0B08A030B44F9DA928E030B9A081A17B54230930BD5C4C804E8EB1
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Packages\Extensions\2974AEB54CF180060A07E97A18011C03B816F82E59FF5F9E0396B9B2DDCCEA7C\e0\icons\32.png
Size 1KB
SHA256 1f1058691b9076053aa4b131963b804dd3055c10e64af69a7241ec819ac9f681
MD5 6eca9ecd18a38c2669b341cf982d79c9
SHA1 f74defb097d39eab2548ade8cbb53ddadb2ebb7f
SHA512 32e97da9ecb6907cf97b3d05467b91766c5fc1c14e0283a2ea8c24ac72f2a000dd99a1ff468de73903f70f0d0d1d2580dd7786948d389b8541f9f75537a8890c
TLSH
T1F621D8125263FDF7F797A13EC1394C51845F0CEAEE183A4AE56633D82B71B5288C1A87
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Packages\Extensions\2974AEB54CF180060A07E97A18011C03B816F82E59FF5F9E0396B9B2DDCCEA7C\e0\icons\48.png
Size 2KB
SHA256 1b4ff05bd3e8712dd081ef5ee246ac1697ad9f2be413d749eefe9bf0baf32e8b
MD5 81d4dab3bd89f34b04f79dc7f3c4096c
SHA1 c1d8ba78f7318a94253ced3a0769256fabc86ec7
SHA512 b24e75cb11129361fd12afbb6d89bccd619f36fd71cfa4d5b437c5b98f91994e1a7d44f4b4dd16617692b8383e0034aa16e5736f1b935a90986798eb27ff5107
TLSH
T17A410B2D89B51B91DA5901FAEF1520B1A8B9DF38113442BFA111EC68194EDFC3182203
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Packages\Extensions\2974AEB54CF180060A07E97A18011C03B816F82E59FF5F9E0396B9B2DDCCEA7C\e0\manifest.json
Size 1KB
SHA256 b0d1371c1bab9fa8d7fd52a86d50e6bdc40b2903207e01a015536197dd5b459e
MD5 935f0951159ace950699c4596c6419f4
SHA1 6faf7b0cd821e740697505e05fe98aa4a9d1c2a4
SHA512 b25bf9864ddddfed5c5f28f2397b0158abfe426f8bf12f54ed792f6a5c9bed056be7d3facc66245718ba208c47a2ed708cbf73c5c10a1ef08bcf08b86653a32a
TLSH
T1F831BE25C9689C6B03DCA73058F65943695419878D947C1C7ADE800C8FBD61F41FBB9C
MD5 SHA1 SHA512 TLSH

Submit Download

service-worker-loader.js

Path C:\Users\Admin\AppData\Local\Packages\Extensions\2974AEB54CF180060A07E97A18011C03B816F82E59FF5F9E0396B9B2DDCCEA7C\e0\service-worker-loader.js
Size 45B
SHA256 11eda63a2c2164aa2c4088a8493ea60ec85a16d5af60f628b9ae540e40b1b1c8
MD5 3c7b976fd45cb98703d686322240d9d7
SHA1 8223f0570d251868893871f641bed115e1c8c153
SHA512 ae674f7b3d374b4d6885856adc27557d75dc7a7ae632797d92e64aa47267a94d3e63443331e1f7723d43556480079af35398128b7605f83e962e853a5a40e529
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_ucktnnv5.53d.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ucktnnv5.53d.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ck_2380_1793092252521484300.bin

Path C:\Users\Admin\AppData\Local\Temp\ck_2380_1793092252521484300.bin
Size 32B
SHA256 184d47368f38346f0378c39656d1680210f5505e1a71fb61b879f5d05e58385f
MD5 afe11b2db143cdedd4bc04b3e2da0632
SHA1 da82ffef7a8259ac9074482c28fd6f18da4d3308
SHA512 cfbed5489d8240d61d530a5eeefeb387f2a26ba14e907e6347ba5049fea5a720167eee77a92bf82179f762d5b7a7a0361027612743f3c9c5e1dc3f6155b6925b
MD5 SHA1 SHA512

Submit Download

memory/3988-40-0x00000231FAE50000-0x00000231FAE60000-memory.dmp

Download

memory/3988-39-0x00000231FAE50000-0x00000231FAE60000-memory.dmp

Download

memory/3988-48-0x00000231FADB0000-0x00000231FADD2000-memory.dmp

Download

memory/3988-49-0x00000231FAE10000-0x00000231FAE3A000-memory.dmp

Download

memory/3988-50-0x00000231FAE10000-0x00000231FAE34000-memory.dmp

Download

memory/3988-51-0x00000231FAE50000-0x00000231FAE60000-memory.dmp

Download