723cd1c1ea377887bc5de7349849b49aff255efcef589eebc4f487ada9916e83

Analysis

max time kernel
149s
max time network
115s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 07:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_2ad15aa49d8b3f627866c029cfeacce7_akira_glassworm_rusty-stealer.exe
Size 1.6MB
Sample260415-jdcn9aby21
SHA256 723cd1c1ea377887bc5de7349849b49aff255efcef589eebc4f487ada9916e83
MD5 2ad15aa49d8b3f627866c029cfeacce7
SHA1 68c34253e8f0c92f3bd6098c9e236aeddbb9b148
SHA512 bcd346b759930b9920fe518e0e18e1a3bb110075070b69684ac4555b14ec8317f448db6b0e778fe32a2973ef243020ec354469997651d50f87890e3676b500e1
SSDEEP 24576:Xm4YhCg+Nns134tuQBHzPL2Wwfu09JlhcvfiHvjSs1sSQ7:tYhCxnTwQWmuJluXwWM87
TLSH
T1A4756D03F69581E8C49DC478C3569633AA32B8CD463576EF2BD40B213E2AFA16F1D716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3344	powershell.exe
4504	powershell.exe
5364	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
2904	install.exe
3972	install.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\install.exe	2026-04-15_2ad15aa49d8b3f627866c029cfeacce7_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\System32\install.exe	attrib.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2484	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5540	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3344	powershell.exe
3344	powershell.exe
2904	install.exe
2904	install.exe
2904	install.exe
2904	install.exe
2904	install.exe
2904	install.exe
2904	install.exe
2904	install.exe
2904	install.exe
2904	install.exe
4504	powershell.exe
4504	powershell.exe
5364	powershell.exe
5364	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3344	powershell.exe
Token: SeIncreaseQuotaPrivilege	3344	powershell.exe
Token: SeSecurityPrivilege	3344	powershell.exe
Token: SeTakeOwnershipPrivilege	3344	powershell.exe
Token: SeLoadDriverPrivilege	3344	powershell.exe
Token: SeSystemProfilePrivilege	3344	powershell.exe
Token: SeSystemtimePrivilege	3344	powershell.exe
Token: SeProfSingleProcessPrivilege	3344	powershell.exe
Token: SeIncBasePriorityPrivilege	3344	powershell.exe
Token: SeCreatePagefilePrivilege	3344	powershell.exe
Token: SeBackupPrivilege	3344	powershell.exe
Token: SeRestorePrivilege	3344	powershell.exe
Token: SeShutdownPrivilege	3344	powershell.exe
Token: SeDebugPrivilege	3344	powershell.exe
Token: SeSystemEnvironmentPrivilege	3344	powershell.exe
Token: SeRemoteShutdownPrivilege	3344	powershell.exe
Token: SeUndockPrivilege	3344	powershell.exe
Token: SeManageVolumePrivilege	3344	powershell.exe
Token: 33	3344	powershell.exe
Token: 34	3344	powershell.exe
Token: 35	3344	powershell.exe
Token: 36	3344	powershell.exe
Token: SeIncreaseQuotaPrivilege	3344	powershell.exe
Token: SeSecurityPrivilege	3344	powershell.exe
Token: SeTakeOwnershipPrivilege	3344	powershell.exe
Token: SeLoadDriverPrivilege	3344	powershell.exe
Token: SeSystemProfilePrivilege	3344	powershell.exe
Token: SeSystemtimePrivilege	3344	powershell.exe
Token: SeProfSingleProcessPrivilege	3344	powershell.exe
Token: SeIncBasePriorityPrivilege	3344	powershell.exe
Token: SeCreatePagefilePrivilege	3344	powershell.exe
Token: SeBackupPrivilege	3344	powershell.exe
Token: SeRestorePrivilege	3344	powershell.exe
Token: SeShutdownPrivilege	3344	powershell.exe
Token: SeDebugPrivilege	3344	powershell.exe
Token: SeSystemEnvironmentPrivilege	3344	powershell.exe
Token: SeRemoteShutdownPrivilege	3344	powershell.exe
Token: SeUndockPrivilege	3344	powershell.exe
Token: SeManageVolumePrivilege	3344	powershell.exe
Token: 33	3344	powershell.exe
Token: 34	3344	powershell.exe
Token: 35	3344	powershell.exe
Token: 36	3344	powershell.exe
Token: SeDebugPrivilege	4504	powershell.exe
Token: SeIncreaseQuotaPrivilege	4504	powershell.exe
Token: SeSecurityPrivilege	4504	powershell.exe
Token: SeTakeOwnershipPrivilege	4504	powershell.exe
Token: SeLoadDriverPrivilege	4504	powershell.exe
Token: SeSystemProfilePrivilege	4504	powershell.exe
Token: SeSystemtimePrivilege	4504	powershell.exe
Token: SeProfSingleProcessPrivilege	4504	powershell.exe
Token: SeIncBasePriorityPrivilege	4504	powershell.exe
Token: SeCreatePagefilePrivilege	4504	powershell.exe
Token: SeBackupPrivilege	4504	powershell.exe
Token: SeRestorePrivilege	4504	powershell.exe
Token: SeShutdownPrivilege	4504	powershell.exe
Token: SeDebugPrivilege	4504	powershell.exe
Token: SeSystemEnvironmentPrivilege	4504	powershell.exe
Token: SeRemoteShutdownPrivilege	4504	powershell.exe
Token: SeUndockPrivilege	4504	powershell.exe
Token: SeManageVolumePrivilege	4504	powershell.exe
Token: 33	4504	powershell.exe
Token: 34	4504	powershell.exe
Token: 35	4504	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 1100	1044	2026-04-15_2ad15aa49d8b3f627866c029cfeacce7_akira_glassworm_rusty-stealer.exe	80
PID 1100 wrote to memory of 5540	1100	cmd.exe	82
PID 1044 wrote to memory of 3540	1044	2026-04-15_2ad15aa49d8b3f627866c029cfeacce7_akira_glassworm_rusty-stealer.exe	83
PID 1044 wrote to memory of 2492	1044	2026-04-15_2ad15aa49d8b3f627866c029cfeacce7_akira_glassworm_rusty-stealer.exe	85
PID 2492 wrote to memory of 2484	2492	cmd.exe	87
PID 2904 wrote to memory of 3344	2904	install.exe	90
PID 2904 wrote to memory of 4504	2904	install.exe	92
PID 2492 wrote to memory of 3972	2492	cmd.exe	94
PID 2904 wrote to memory of 3864	2904	install.exe	95
PID 2904 wrote to memory of 5364	2904	install.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3540	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-04-15_2ad15aa49d8b3f627866c029cfeacce7_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_2ad15aa49d8b3f627866c029cfeacce7_akira_glassworm_rusty-stealer.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /f /sc onlogon /rl highest /tn \"install\" /tr '\"C:\Windows\System32\install.exe\"'"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1100
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn \"install\" /tr '\"C:\Windows\System32\install.exe\"'
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5540
- C:\Windows\system32\attrib.exe
  "attrib" +h C:\Windows\System32\install.exe
  2⤵
  - Drops file in System32 directory
  - Views/modifies file attributes
  PID:3540
- C:\Windows\system32\cmd.exe
  cmd.exe /e:ON /v:OFF /d /c ""C:\Users\Admin\AppData\Local\Temp\r.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2492
- - C:\Windows\system32\timeout.exe
    timeout /t 3
    3⤵
    - Delays execution with timeout.exe
    PID:2484
- - C:\Windows\System32\install.exe
    "C:\Windows\System32\install.exe"
    3⤵
    - Executes dropped EXE
    PID:3972

C:\Windows\System32\install.exe
""C:\Windows\System32\install.exe""
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance Win32_ComputerSystem | Select-Object -ExpandProperty Model; Get-CimInstance Win32_ComputerSystem | Select-Object -ExpandProperty Manufacturer"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -Command " $cpu = Get-CimInstance Win32_Processor $cpu.Manufacturer $cpu.Family $cpu.Description "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4504
- C:\Windows\System32\cmd.exe
  "cmd" /C "vol C:"
  2⤵
  PID:3864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-NetFirewallProfile | Select-Object -ExpandProperty Enabled"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 7f8f97ee615f534fb3a3d4ab1d554cd33b788f10c559754714d1e7ce0726b362
MD5 a71e351e0584693771a3e1ab5ed855ee
SHA1 5bbadb2db8240a293fce7bf6a965634703e51aa4
SHA512 95148933c9fc727c3f88c9b5a0bd489f660bc0b24b3cb8b8e6e7ffbec937810d473cf57ff0c8a34075ce7f822f0c007be8893daa409738cd4782ab526bb5a185
TLSH
T18B71EE323375B0D4C9663F07192C1AC463BF4396EA58AF4CB658521ED92710BDB222F7
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 527583dacd97ac0330fcd30a301b422dc2b9894b292a38188ade6c96df764667
MD5 7a0e7ce4c6a682fdcfc2d5e11cfd14d8
SHA1 82fd69f2e9e6e3ba7865da5159a9bb74820585cd
SHA512 f74c1c0f1ec546836f8d34d98895a028518eefd8eecc4e011448b59c0a61ef1bbc661488675097965a1806b28e272680d6699d0767c777a4280e910c47c27381
TLSH
T1F0218B33B79DC165C8D9117A20CCAD00B275C3C744DECF8B2A84C229A97F5DADB945E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f1695dbae8336f6f926f520a43a4022a4408fb194d3a215fb8ad29a3a64754c4
MD5 64f299bb478c8ac7e68eba44307df9c5
SHA1 597fdea7afae24abecbaedb1ada6ae950f5b86dc
SHA512 a32b1b34ff8da6089210ce0ff79596ae22e27cc711efa83f8a5a67badc4489bd694b4b75865039198468b066d0f936e847156b427254c6dde3fa7945a76e750e
TLSH
T12A218B33B79DC165C8D9117A208CAD00B275C3C744DFCF8B2A84C228A97F5DADB945E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_4sk3pof3.n41.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4sk3pof3.n41.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

r.bat

Path C:\Users\Admin\AppData\Local\Temp\r.bat
Size 89B
SHA256 859633939e5d99e9822ee1d6407e3ed34c410212c7360ce0af871f7537f9228b
MD5 dcc2f803c3702178b48135e50b7d3621
SHA1 79073d9cd27d42d3924680fde1fb53fc61c2ad06
SHA512 445b68f3e5260d4c8636ed544a3f1cdfbe254c70f06b616dd5a13082239fd8196cedd8f1a9ce360562d32b62356479608e1bd2aa2e57ff9a264b5383c4aa96c4
TLSH
T1EBB02401474150D077D11C10104F5151730DF0CF0C00D41015C73450CC0700D445F4C5
MD5 SHA1 SHA512 TLSH

Submit Download

install.exe

Path C:\Windows\System32\install.exe
Size 1.6MB
SHA256 723cd1c1ea377887bc5de7349849b49aff255efcef589eebc4f487ada9916e83
MD5 2ad15aa49d8b3f627866c029cfeacce7
SHA1 68c34253e8f0c92f3bd6098c9e236aeddbb9b148
SHA512 bcd346b759930b9920fe518e0e18e1a3bb110075070b69684ac4555b14ec8317f448db6b0e778fe32a2973ef243020ec354469997651d50f87890e3676b500e1
SSDEEP 24576:Xm4YhCg+Nns134tuQBHzPL2Wwfu09JlhcvfiHvjSs1sSQ7:tYhCxnTwQWmuJluXwWM87
TLSH
T1A4756D03F69581E8C49DC478C3569633AA32B8CD463576EF2BD40B213E2AFA16F1D716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2484-28-0x0000015EFD800000-0x0000015EFD85D000-memory.dmp

Download

memory/3344-5-0x0000019879D60000-0x0000019879D82000-memory.dmp

Download

memory/3344-22-0x000001987A0C0000-0x000001987A0E4000-memory.dmp

Download

memory/3344-25-0x00000198614C0000-0x000001986151D000-memory.dmp

Download

memory/3344-27-0x00000198619F0000-0x0000019861A02000-memory.dmp

Download

memory/3344-26-0x00000198618D0000-0x00000198618DC000-memory.dmp

Download

memory/3344-20-0x0000019879FA0000-0x0000019879FAA000-memory.dmp

Download

memory/3344-19-0x0000019879FD0000-0x000001987A083000-memory.dmp

Download

memory/3344-18-0x0000019879FB0000-0x0000019879FCC000-memory.dmp

Download

memory/3344-21-0x000001987A0C0000-0x000001987A0EA000-memory.dmp

Download

memory/4504-47-0x000001FD2D530000-0x000001FD2D542000-memory.dmp

Download

memory/4504-45-0x000001FD135B0000-0x000001FD1360D000-memory.dmp

Download

memory/4504-46-0x000001FD13670000-0x000001FD1367C000-memory.dmp

Download

memory/5364-61-0x000002CD544C0000-0x000002CD544DC000-memory.dmp

Download

memory/5364-63-0x000002CD54500000-0x000002CD5451A000-memory.dmp

Download

memory/5364-62-0x000002CD544A0000-0x000002CD544AE000-memory.dmp

Download

memory/5364-67-0x000002CD3BCC0000-0x000002CD3BCD2000-memory.dmp

Download

memory/5364-66-0x000002CD3B7A0000-0x000002CD3B7AC000-memory.dmp

Download

memory/5364-65-0x000002CD3B690000-0x000002CD3B6ED000-memory.dmp

Download