Analysis
- max time kernel
148s - max time network
153s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
15/04/2026, 12:52
General
- Target 2026-04-15_3982b886abba95ac889cb18b0b0a2089_akira_glassworm_icedid_ngrbot_quasar-rat_rusty-stealer.exe
- Size 6.4MB
- Sample260415-p4et7aht21
- SHA256 415316743b950f8c332bc4a601e990fc7230848c59efb64e18d95525df9d3d67
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Using powershell.exe command.
- Disables one or more Microsoft Defender components 1 TTPs 1 IoCs
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
- Drops file in Drivers directory 3 IoCs
- Disables automatic submission of suspicious files to Microsoft by Windows Defender 1 TTPs 1 IoCs
Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.
- Executes dropped EXE 1 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Kills process with taskkill 4 IoCs
- Suspicious behavior: EnumeratesProcesses 40 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
- Views/modifies file attributes 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_3982b886abba95ac889cb18b0b0a2089_akira_glassworm_icedid_ngrbot_quasar-rat_rusty-stealer.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_3982b886abba95ac889cb18b0b0a2089_akira_glassworm_icedid_ngrbot_quasar-rat_rusty-stealer.exe"1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\2026-04-15_3982b886abba95ac889cb18b0b0a2089_akira_glassworm_icedid_ngrbot_quasar-rat_rusty-stealer.exe2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend2⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Set-MpPreference -SubmitSamplesConsent 22⤵
- Command and Scripting Interpreter: PowerShell
- Disables automatic submission of suspicious files to Microsoft by Windows Defender
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\attrib.exe"attrib" -r C:\Windows\System32\drivers\etc\hosts2⤵
- Drops file in Drivers directory
- Views/modifies file attributes
-
-
C:\Windows\system32\attrib.exe"attrib" +r C:\Windows\System32\drivers\etc\hosts2⤵
- Drops file in Drivers directory
- Views/modifies file attributes
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM Discord.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM DiscordCanary.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM DiscordPTB.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM DiscordDevelopment.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -NoLogo -Command "[Console]::OutputEncoding = [System.Text.Encoding]::UTF8; Get-Culture | Select -ExpandProperty DisplayName"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\K7RKScan_1516.sysC:\Users\Admin\AppData\Local\Temp\K7RKScan_1516.sys1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
K7RKScan_1516.sys
__PSScriptPolicyTest_ru5gjfuy.e2s.ps1
hosts
memory/416-85-0x000001F56CB00000-0x000001F56CB6F000-memory.dmp
memory/2312-0-0x000001D9C08A0000-0x000001D9C093E000-memory.dmp
memory/2312-9-0x000001D9C08A0000-0x000001D9C093E000-memory.dmp
memory/3608-39-0x000001DCDE4F0000-0x000001DCDE4FC000-memory.dmp
memory/3608-10-0x000001DCDEAA0000-0x000001DCDEAB0000-memory.dmp
memory/3608-29-0x000001DCF6DF0000-0x000001DCF6DFA000-memory.dmp
memory/3608-30-0x000001DCF7280000-0x000001DCF729C000-memory.dmp
memory/3608-31-0x000001DCF7010000-0x000001DCF701A000-memory.dmp
memory/3608-32-0x000001DCF72C0000-0x000001DCF72DA000-memory.dmp
memory/3608-33-0x000001DCF7020000-0x000001DCF7028000-memory.dmp
memory/3608-34-0x000001DCF72A0000-0x000001DCF72A6000-memory.dmp
memory/3608-35-0x000001DCF72B0000-0x000001DCF72BA000-memory.dmp
memory/3608-36-0x000001DCDEAA0000-0x000001DCDEAB0000-memory.dmp
memory/3608-27-0x000001DCF6D10000-0x000001DCF6D2C000-memory.dmp
memory/3608-40-0x000001DCDEA70000-0x000001DCDEA82000-memory.dmp
memory/3608-41-0x000001DCF6C20000-0x000001DCF6C8F000-memory.dmp
memory/3608-20-0x00007FF41E200000-0x00007FF41E210000-memory.dmp
memory/3608-19-0x000001DCDEAA0000-0x000001DCDEAB0000-memory.dmp
memory/3608-11-0x000001DCDEAA0000-0x000001DCDEAB0000-memory.dmp
memory/3608-28-0x000001DCF6D30000-0x000001DCF6DE3000-memory.dmp
memory/3608-18-0x000001DCF6BF0000-0x000001DCF6C12000-memory.dmp
memory/4616-95-0x000002008EA10000-0x000002008EA22000-memory.dmp
memory/4616-94-0x000002008E850000-0x000002008E85C000-memory.dmp
memory/4616-96-0x00000200A6C60000-0x00000200A6CCF000-memory.dmp
memory/5084-59-0x0000015BBED00000-0x0000015BBED12000-memory.dmp
memory/5084-57-0x0000015BBD200000-0x0000015BBD29E000-memory.dmp
memory/5084-58-0x0000015BBD3B0000-0x0000015BBD3BC000-memory.dmp
memory/5156-74-0x00000242F09F0000-0x00000242F09FC000-memory.dmp
memory/5156-76-0x00000242F2960000-0x00000242F29CF000-memory.dmp
memory/5156-75-0x00000242F27C0000-0x00000242F27D2000-memory.dmp
memory/5172-8-0x0000000000010000-0x000000000001A000-memory.dmp
memory/5412-82-0x00000176ABF40000-0x00000176ABFAF000-memory.dmp
memory/5532-84-0x000002640C470000-0x000002640C4DF000-memory.dmp
memory/5544-83-0x0000020F8AA70000-0x0000020F8AADF000-memory.dmp