723cd1c1ea377887bc5de7349849b49aff255efcef589eebc4f487ada9916e83

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/04/2026, 07:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_2ad15aa49d8b3f627866c029cfeacce7_akira_glassworm_rusty-stealer.exe
Size 1.6MB
Sample260415-jdcn9aby21
SHA256 723cd1c1ea377887bc5de7349849b49aff255efcef589eebc4f487ada9916e83
MD5 2ad15aa49d8b3f627866c029cfeacce7
SHA1 68c34253e8f0c92f3bd6098c9e236aeddbb9b148
SHA512 bcd346b759930b9920fe518e0e18e1a3bb110075070b69684ac4555b14ec8317f448db6b0e778fe32a2973ef243020ec354469997651d50f87890e3676b500e1
SSDEEP 24576:Xm4YhCg+Nns134tuQBHzPL2Wwfu09JlhcvfiHvjSs1sSQ7:tYhCxnTwQWmuJluXwWM87
TLSH
T1A4756D03F69581E8C49DC478C3569633AA32B8CD463576EF2BD40B213E2AFA16F1D716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2564	powershell.exe
4164	powershell.exe
5268	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
1556	install.exe
752	install.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\install.exe	2026-04-15_2ad15aa49d8b3f627866c029cfeacce7_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\System32\install.exe	attrib.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5908	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5432	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2564	powershell.exe
2564	powershell.exe
1556	install.exe
1556	install.exe
1556	install.exe
1556	install.exe
1556	install.exe
1556	install.exe
1556	install.exe
1556	install.exe
1556	install.exe
1556	install.exe
4164	powershell.exe
4164	powershell.exe
5268	powershell.exe
5268	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2564	powershell.exe
Token: SeIncreaseQuotaPrivilege	2564	powershell.exe
Token: SeSecurityPrivilege	2564	powershell.exe
Token: SeTakeOwnershipPrivilege	2564	powershell.exe
Token: SeLoadDriverPrivilege	2564	powershell.exe
Token: SeSystemProfilePrivilege	2564	powershell.exe
Token: SeSystemtimePrivilege	2564	powershell.exe
Token: SeProfSingleProcessPrivilege	2564	powershell.exe
Token: SeIncBasePriorityPrivilege	2564	powershell.exe
Token: SeCreatePagefilePrivilege	2564	powershell.exe
Token: SeBackupPrivilege	2564	powershell.exe
Token: SeRestorePrivilege	2564	powershell.exe
Token: SeShutdownPrivilege	2564	powershell.exe
Token: SeDebugPrivilege	2564	powershell.exe
Token: SeSystemEnvironmentPrivilege	2564	powershell.exe
Token: SeRemoteShutdownPrivilege	2564	powershell.exe
Token: SeUndockPrivilege	2564	powershell.exe
Token: SeManageVolumePrivilege	2564	powershell.exe
Token: 33	2564	powershell.exe
Token: 34	2564	powershell.exe
Token: 35	2564	powershell.exe
Token: 36	2564	powershell.exe
Token: SeIncreaseQuotaPrivilege	2564	powershell.exe
Token: SeSecurityPrivilege	2564	powershell.exe
Token: SeTakeOwnershipPrivilege	2564	powershell.exe
Token: SeLoadDriverPrivilege	2564	powershell.exe
Token: SeSystemProfilePrivilege	2564	powershell.exe
Token: SeSystemtimePrivilege	2564	powershell.exe
Token: SeProfSingleProcessPrivilege	2564	powershell.exe
Token: SeIncBasePriorityPrivilege	2564	powershell.exe
Token: SeCreatePagefilePrivilege	2564	powershell.exe
Token: SeBackupPrivilege	2564	powershell.exe
Token: SeRestorePrivilege	2564	powershell.exe
Token: SeShutdownPrivilege	2564	powershell.exe
Token: SeDebugPrivilege	2564	powershell.exe
Token: SeSystemEnvironmentPrivilege	2564	powershell.exe
Token: SeRemoteShutdownPrivilege	2564	powershell.exe
Token: SeUndockPrivilege	2564	powershell.exe
Token: SeManageVolumePrivilege	2564	powershell.exe
Token: 33	2564	powershell.exe
Token: 34	2564	powershell.exe
Token: 35	2564	powershell.exe
Token: 36	2564	powershell.exe
Token: SeDebugPrivilege	4164	powershell.exe
Token: SeIncreaseQuotaPrivilege	4164	powershell.exe
Token: SeSecurityPrivilege	4164	powershell.exe
Token: SeTakeOwnershipPrivilege	4164	powershell.exe
Token: SeLoadDriverPrivilege	4164	powershell.exe
Token: SeSystemProfilePrivilege	4164	powershell.exe
Token: SeSystemtimePrivilege	4164	powershell.exe
Token: SeProfSingleProcessPrivilege	4164	powershell.exe
Token: SeIncBasePriorityPrivilege	4164	powershell.exe
Token: SeCreatePagefilePrivilege	4164	powershell.exe
Token: SeBackupPrivilege	4164	powershell.exe
Token: SeRestorePrivilege	4164	powershell.exe
Token: SeShutdownPrivilege	4164	powershell.exe
Token: SeDebugPrivilege	4164	powershell.exe
Token: SeSystemEnvironmentPrivilege	4164	powershell.exe
Token: SeRemoteShutdownPrivilege	4164	powershell.exe
Token: SeUndockPrivilege	4164	powershell.exe
Token: SeManageVolumePrivilege	4164	powershell.exe
Token: 33	4164	powershell.exe
Token: 34	4164	powershell.exe
Token: 35	4164	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4540 wrote to memory of 5220	4540	2026-04-15_2ad15aa49d8b3f627866c029cfeacce7_akira_glassworm_rusty-stealer.exe	85
PID 5220 wrote to memory of 5432	5220	cmd.exe	87
PID 4540 wrote to memory of 6016	4540	2026-04-15_2ad15aa49d8b3f627866c029cfeacce7_akira_glassworm_rusty-stealer.exe	88
PID 4540 wrote to memory of 1872	4540	2026-04-15_2ad15aa49d8b3f627866c029cfeacce7_akira_glassworm_rusty-stealer.exe	90
PID 1872 wrote to memory of 5908	1872	cmd.exe	92
PID 1556 wrote to memory of 2564	1556	install.exe	95
PID 1556 wrote to memory of 4164	1556	install.exe	97
PID 1872 wrote to memory of 752	1872	cmd.exe	99
PID 1556 wrote to memory of 5284	1556	install.exe	100
PID 1556 wrote to memory of 5268	1556	install.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
6016	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-04-15_2ad15aa49d8b3f627866c029cfeacce7_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_2ad15aa49d8b3f627866c029cfeacce7_akira_glassworm_rusty-stealer.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /f /sc onlogon /rl highest /tn \"install\" /tr '\"C:\Windows\System32\install.exe\"'"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5220
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn \"install\" /tr '\"C:\Windows\System32\install.exe\"'
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5432
- C:\Windows\system32\attrib.exe
  "attrib" +h C:\Windows\System32\install.exe
  2⤵
  - Drops file in System32 directory
  - Views/modifies file attributes
  PID:6016
- C:\Windows\system32\cmd.exe
  cmd.exe /e:ON /v:OFF /d /c ""C:\Users\Admin\AppData\Local\Temp\r.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1872
- - C:\Windows\system32\timeout.exe
    timeout /t 3
    3⤵
    - Delays execution with timeout.exe
    PID:5908
- - C:\Windows\System32\install.exe
    "C:\Windows\System32\install.exe"
    3⤵
    - Executes dropped EXE
    PID:752

C:\Windows\System32\install.exe
""C:\Windows\System32\install.exe""
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance Win32_ComputerSystem | Select-Object -ExpandProperty Model; Get-CimInstance Win32_ComputerSystem | Select-Object -ExpandProperty Manufacturer"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -Command " $cpu = Get-CimInstance Win32_Processor $cpu.Manufacturer $cpu.Family $cpu.Description "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4164
- C:\Windows\System32\cmd.exe
  "cmd" /C "vol C:"
  2⤵
  PID:5284
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-NetFirewallProfile | Select-Object -ExpandProperty Enabled"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 b58f994c644f7b4a831e889630bfd7ca0860aeb1e0920dc0f5d4928585a9dbab
MD5 3bfc414667e1ebc31e9259fa1db290fa
SHA1 9bff989429779efef334e5524a362e7b6ff266cb
SHA512 e6cb000e8f900132f7dc661f943b8e91e945d171157ff3289b91e9d79f70230e363ed65b7ec97f451b376cf4706a14de9a86193e72dcea8fe3aa8c86c6117d13
TLSH
T1E371BF323375B0D4C9567F072A2819C063BF4396EA98AF4CB25C621ED92751B9B122F7
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 407260be23827f74d0a970f14ff77357116b1154445793ac62d996a3cea90599
MD5 13e1ccc50dc6c065920968bf8fd7956f
SHA1 26b101b97197c4dda9fe9e49bf6094675fdb68df
SHA512 dbc9118519d9b9b841eb65225dc2cc8a4705bab8e76e88491921fddc4b3a722572981d79e11bfbd04f8d07fcd0dd89bf1db4659ee5f2b4e07987f6bb65d9f60e
TLSH
T136218727B39CC821CC99153A209DAC1172B683C7809ECF8F6FC0D224A07FAC4CB71594
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a1ea1dab0972db3a1b9806ec90036ec0c3a68eac135b2b33db0873cdc5668557
MD5 139370695d63f7f487e7a412839ec6d5
SHA1 b0a640dce5d3fab13e722e02d6d8c1e82abf2ac1
SHA512 e04e7c617d17e7ae4814cbf6d6072130aa7e2ca5b434fdcc4efc4e64e28d77960c5be2fbe790a0332cf7522ba26550467a6ad3ea8dde0d689204044007830e9a
TLSH
T1F8218727B39CC921CC99153A209DAC5172B683C7809ECF8F6FC0D224A57FAC4CB71590
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_b4qx3wrx.nbr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b4qx3wrx.nbr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

r.bat

Path C:\Users\Admin\AppData\Local\Temp\r.bat
Size 89B
SHA256 859633939e5d99e9822ee1d6407e3ed34c410212c7360ce0af871f7537f9228b
MD5 dcc2f803c3702178b48135e50b7d3621
SHA1 79073d9cd27d42d3924680fde1fb53fc61c2ad06
SHA512 445b68f3e5260d4c8636ed544a3f1cdfbe254c70f06b616dd5a13082239fd8196cedd8f1a9ce360562d32b62356479608e1bd2aa2e57ff9a264b5383c4aa96c4
TLSH
T1EBB02401474150D077D11C10104F5151730DF0CF0C00D41015C73450CC0700D445F4C5
MD5 SHA1 SHA512 TLSH

Submit Download

install.exe

Path C:\Windows\System32\install.exe
Size 1.6MB
SHA256 723cd1c1ea377887bc5de7349849b49aff255efcef589eebc4f487ada9916e83
MD5 2ad15aa49d8b3f627866c029cfeacce7
SHA1 68c34253e8f0c92f3bd6098c9e236aeddbb9b148
SHA512 bcd346b759930b9920fe518e0e18e1a3bb110075070b69684ac4555b14ec8317f448db6b0e778fe32a2973ef243020ec354469997651d50f87890e3676b500e1
SSDEEP 24576:Xm4YhCg+Nns134tuQBHzPL2Wwfu09JlhcvfiHvjSs1sSQ7:tYhCxnTwQWmuJluXwWM87
TLSH
T1A4756D03F69581E8C49DC478C3569633AA32B8CD463576EF2BD40B213E2AFA16F1D716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/752-31-0x000002B88DB10000-0x000002B88DCB1000-memory.dmp

Download

memory/1556-48-0x000001E495C20000-0x000001E495DC1000-memory.dmp

Download

memory/2564-19-0x0000019F800D0000-0x0000019F800DC000-memory.dmp

Download

memory/2564-18-0x0000019FFDBE0000-0x0000019FFDD81000-memory.dmp

Download

memory/2564-6-0x0000019FFF950000-0x0000019FFF972000-memory.dmp

Download

memory/2564-15-0x0000019FFF980000-0x0000019FFF9A4000-memory.dmp

Download

memory/2564-14-0x0000019FFF980000-0x0000019FFF9AA000-memory.dmp

Download

memory/4164-33-0x000001FA21F10000-0x000001FA220B1000-memory.dmp

Download

memory/4164-34-0x000001FA23D10000-0x000001FA23D1C000-memory.dmp

Download

memory/4540-3-0x000001107BE40000-0x000001107BFE1000-memory.dmp

Download

memory/5268-44-0x0000020CCA5D0000-0x0000020CCA5EA000-memory.dmp

Download

memory/5268-43-0x0000020CCA5A0000-0x0000020CCA5AE000-memory.dmp

Download

memory/5268-47-0x0000020CB1C30000-0x0000020CB1C3C000-memory.dmp

Download

memory/5268-46-0x0000020CB0170000-0x0000020CB0311000-memory.dmp

Download

memory/5908-29-0x000002093DBA0000-0x000002093DBD0000-memory.dmp

Download