Analysis
- max time kernel
149s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
29/10/2026, 21:54
General
- Target 2026-10-28_a4f8015663dc62327b8c59365210ada3_akira_elex_glassworm_icedid_njrat_stealc.exe
- Size 15.6MB
- Sample261029-1sewlatsds
- SHA256 fe7981b4822f06a6c5bfb6d36500997d9eceb121e560af81220b0ccdd63f45af
Malware Config
Signatures
- Custom signatureDetects executables manipulated with Fody 1 IoCs
- Custom signatureDetects executables packed with ConfuserEx Mod 11 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- ConfuserEx .NET packer 11 IoCs
Detects ConfuserEx .NET packer.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 5 IoCs
- Modifies system certificate store 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 42 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-28_a4f8015663dc62327b8c59365210ada3_akira_elex_glassworm_icedid_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-28_a4f8015663dc62327b8c59365210ada3_akira_elex_glassworm_icedid_njrat_stealc.exe"1⤵
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Enumerates system info in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3480-0-0x00007FF85DD7F000-0x00007FF85DD80000-memory.dmp
memory/3480-1-0x0000019C076E0000-0x0000019C08670000-memory.dmp
memory/3480-2-0x00007FF85DBF0000-0x00007FF85E594000-memory.dmp
memory/3480-3-0x00007FF85DBF0000-0x00007FF85E594000-memory.dmp
memory/3480-4-0x00007FF85DBF0000-0x00007FF85E594000-memory.dmp
memory/3480-5-0x00007FF85DBF0000-0x00007FF85E594000-memory.dmp
memory/3480-7-0x0000019C08AD0000-0x0000019C08AF4000-memory.dmp
memory/3480-8-0x0000019C08AF0000-0x0000019C08B0A000-memory.dmp
memory/3480-10-0x0000019C22DC0000-0x0000019C22E94000-memory.dmp
memory/3480-9-0x0000019C0A4C0000-0x0000019C0A5AE000-memory.dmp
memory/3480-6-0x0000019C08AB0000-0x0000019C08ABA000-memory.dmp
memory/3480-11-0x00007FF85DBF0000-0x00007FF85E594000-memory.dmp
memory/3480-20-0x00007FF85DBF0000-0x00007FF85E594000-memory.dmp
memory/3480-23-0x0000019C22F90000-0x0000019C22F9C000-memory.dmp
memory/3480-24-0x0000019C22FB0000-0x0000019C22FDC000-memory.dmp
memory/3480-26-0x0000019C23030000-0x0000019C23046000-memory.dmp
memory/3480-25-0x0000019C23D00000-0x0000019C23D7E000-memory.dmp
memory/3480-27-0x0000019C23CB0000-0x0000019C23CBC000-memory.dmp
memory/3480-28-0x0000019C23D80000-0x0000019C23E40000-memory.dmp
memory/3480-29-0x0000019C23E40000-0x0000019C23EA8000-memory.dmp
memory/3480-30-0x0000019C23CE0000-0x0000019C23CF4000-memory.dmp
memory/3480-31-0x0000019C23FD0000-0x0000019C24062000-memory.dmp
memory/3480-33-0x0000019C24180000-0x0000019C241CC000-memory.dmp
memory/3480-32-0x0000019C240D0000-0x0000019C24180000-memory.dmp
memory/3480-34-0x0000019C242D0000-0x0000019C243D2000-memory.dmp
memory/3480-35-0x0000019C243D0000-0x0000019C24462000-memory.dmp
memory/3480-39-0x0000019C24080000-0x0000019C24088000-memory.dmp
memory/3480-41-0x0000019C23CC0000-0x0000019C23CCA000-memory.dmp
memory/3480-40-0x0000019C23CA0000-0x0000019C23CAA000-memory.dmp
memory/3480-38-0x0000019C24070000-0x0000019C24078000-memory.dmp
memory/3480-37-0x0000019C24060000-0x0000019C2406A000-memory.dmp
memory/3480-42-0x0000019C240A0000-0x0000019C240C2000-memory.dmp
memory/3480-36-0x0000019C23EB0000-0x0000019C23EBA000-memory.dmp
memory/3480-45-0x0000019C245E0000-0x0000019C24606000-memory.dmp
memory/3480-46-0x0000019C24610000-0x0000019C24618000-memory.dmp
memory/3480-44-0x0000019C23FC0000-0x0000019C23FCA000-memory.dmp
memory/3480-43-0x0000019C24B20000-0x0000019C25048000-memory.dmp
memory/3480-47-0x00007FF85DBF0000-0x00007FF85E594000-memory.dmp
memory/3480-48-0x0000019C246C0000-0x0000019C246C8000-memory.dmp
memory/3480-49-0x0000019C24820000-0x0000019C24850000-memory.dmp
memory/3480-50-0x0000019C24800000-0x0000019C24812000-memory.dmp
memory/3480-51-0x0000019C24A90000-0x0000019C24A98000-memory.dmp
memory/3480-52-0x00007FF85DBF0000-0x00007FF85E594000-memory.dmp
memory/3480-53-0x00007FF85DBF0000-0x00007FF85E594000-memory.dmp
memory/3480-55-0x0000019C24AF0000-0x0000019C24AFE000-memory.dmp
memory/3480-54-0x0000019C26090000-0x0000019C260CE000-memory.dmp
memory/3480-56-0x00007FF85DBF0000-0x00007FF85E594000-memory.dmp
memory/3480-57-0x00007FF85DBF0000-0x00007FF85E594000-memory.dmp
memory/3480-58-0x00007FF85DBF0000-0x00007FF85E594000-memory.dmp
memory/3480-59-0x00007FF85DBF0000-0x00007FF85E594000-memory.dmp
memory/3480-60-0x00007FF85DBF0000-0x00007FF85E594000-memory.dmp
memory/3480-61-0x00007FF85DBF0000-0x00007FF85E594000-memory.dmp
memory/3480-62-0x00007FF85DBF0000-0x00007FF85E594000-memory.dmp