fce6e6cb5eb23e8b35a95c4a57d656b0b118dc464d6c521dcebe4e9148bf6787

Windows Service

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	dllhost64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	dllhost64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	dllhost64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	dllhost64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	dllhost64.exe

Modifies Windows Defender notification settings 3 TTPs 4 IoCs

defense_evasion trojan

Windows Service

Modify Registry

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	dllhost64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	dllhost64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications	dllhost64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	dllhost64.exe

Custom signature

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 4 IoCs

resource	yara_rule
behavioral2/memory/4152-37-0x00000000011D0000-0x0000000001249000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4152-57-0x00000000011D0000-0x0000000001249000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4152-63-0x00000000011D0000-0x0000000001249000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4152-65-0x00000000011D0000-0x0000000001249000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Custom signature

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/memory/4152-37-0x00000000011D0000-0x0000000001249000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Custom signature

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
behavioral2/files/0x001b00000002b201-16.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Enumerates VirtualBox registry keys 2 TTPs 3 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	2026-04-24_e51589fd379b776e78a6f6eab257e069_akira_icedid_quasar-rat_rusty-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	2026-04-24_e51589fd379b776e78a6f6eab257e069_akira_icedid_quasar-rat_rusty-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	2026-04-24_e51589fd379b776e78a6f6eab257e069_akira_icedid_quasar-rat_rusty-stealer.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	2026-04-24_e51589fd379b776e78a6f6eab257e069_akira_icedid_quasar-rat_rusty-stealer.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	2026-04-24_e51589fd379b776e78a6f6eab257e069_akira_icedid_quasar-rat_rusty-stealer.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 3 IoCs

pid	Process
4152	dllhost64.exe
1140	dllhost64.exe
1348	dllhost64.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wine	2026-04-24_e51589fd379b776e78a6f6eab257e069_akira_icedid_quasar-rat_rusty-stealer.exe

Loads dropped DLL 3 IoCs

pid	Process
4152	dllhost64.exe
1140	dllhost64.exe
1348	dllhost64.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinAppVerifier = "C:\\ProgramData\\Microsoft\\WinAppVerifier\\dllhost64.exe"	dllhost64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
3816	netstat.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3816	netstat.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD7CF5D0792}\InprocServer32\ThreadingModel = "Both"	dllhost64.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD7CF5D0792}\InprocServer32	dllhost64.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID	dllhost64.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD7CF5D0792}	dllhost64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD7CF5D0792}\InprocServer32\ = "C:\\ProgramData\\Microsoft\\WinAppVerifier\\dnssd.dll"	dllhost64.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2932	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2716	2026-04-24_e51589fd379b776e78a6f6eab257e069_akira_icedid_quasar-rat_rusty-stealer.exe
2716	2026-04-24_e51589fd379b776e78a6f6eab257e069_akira_icedid_quasar-rat_rusty-stealer.exe
2716	2026-04-24_e51589fd379b776e78a6f6eab257e069_akira_icedid_quasar-rat_rusty-stealer.exe
2716	2026-04-24_e51589fd379b776e78a6f6eab257e069_akira_icedid_quasar-rat_rusty-stealer.exe
2716	2026-04-24_e51589fd379b776e78a6f6eab257e069_akira_icedid_quasar-rat_rusty-stealer.exe
2716	2026-04-24_e51589fd379b776e78a6f6eab257e069_akira_icedid_quasar-rat_rusty-stealer.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe
4152	dllhost64.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
676	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3816	netstat.exe
Token: SeSecurityPrivilege	2084	mofcomp.exe
Token: SeDebugPrivilege	2716	2026-04-24_e51589fd379b776e78a6f6eab257e069_akira_icedid_quasar-rat_rusty-stealer.exe
Token: SeSecurityPrivilege	2200	mofcomp.exe
Token: SeSecurityPrivilege	1584	mofcomp.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 3816	2716	2026-04-24_e51589fd379b776e78a6f6eab257e069_akira_icedid_quasar-rat_rusty-stealer.exe	80
PID 2716 wrote to memory of 4724	2716	2026-04-24_e51589fd379b776e78a6f6eab257e069_akira_icedid_quasar-rat_rusty-stealer.exe	82
PID 2716 wrote to memory of 2084	2716	2026-04-24_e51589fd379b776e78a6f6eab257e069_akira_icedid_quasar-rat_rusty-stealer.exe	84
PID 2716 wrote to memory of 4152	2716	2026-04-24_e51589fd379b776e78a6f6eab257e069_akira_icedid_quasar-rat_rusty-stealer.exe	86
PID 2716 wrote to memory of 2932	2716	2026-04-24_e51589fd379b776e78a6f6eab257e069_akira_icedid_quasar-rat_rusty-stealer.exe	92
PID 4152 wrote to memory of 3996	4152	dllhost64.exe	97
PID 3996 wrote to memory of 792	3996	cmd.exe	99
PID 792 wrote to memory of 2524	792	net.exe	100
PID 3996 wrote to memory of 2224	3996	cmd.exe	101
PID 2224 wrote to memory of 3568	2224	net.exe	102
PID 3996 wrote to memory of 4380	3996	cmd.exe	103
PID 4380 wrote to memory of 1100	4380	net.exe	104

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-04-24_e51589fd379b776e78a6f6eab257e069_akira_icedid_quasar-rat_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-24_e51589fd379b776e78a6f6eab257e069_akira_icedid_quasar-rat_rusty-stealer.exe"
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Identifies Wine through registry keys
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Windows\system32\netstat.exe
  "netstat" -ano
  2⤵
  - System Network Connections Discovery
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:3816
- C:\Windows\system32\schtasks.exe
  "schtasks" /Delete /TN \Microsoft\Windows\AppTask\SyncHost-{05A7B-E0190-482BF-A7C1} /F
  2⤵
  PID:4724
- C:\Windows\System32\Wbem\mofcomp.exe
  "mofcomp.exe" C:\Users\Admin\AppData\Local\Temp\_cl.mof
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2084
- C:\Users\Admin\AppData\Local\AppXCache\dllhost64.exe
  "C:\Users\Admin\AppData\Local\AppXCache\dllhost64.exe"
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Modifies Windows Defender notification settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4152
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c net stop WinDefend /y >nul 2>&1 & net stop wscsvc /y >nul 2>&1 & net stop Sense /y >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3996
  - - C:\Windows\system32\net.exe
      net stop WinDefend /y
      4⤵
      Suspicious use of WriteProcessMemory
      PID:792
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop WinDefend /y
        5⤵
        
        PID:2524
  - - C:\Windows\system32\net.exe
      net stop wscsvc /y
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2224
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop wscsvc /y
        5⤵
        
        PID:3568
  - - C:\Windows\system32\net.exe
      net stop Sense /y
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4380
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop Sense /y
        5⤵
        
        PID:1100
- C:\Windows\System32\Wbem\mofcomp.exe
  mofcomp.exe "C:\Users\Admin\AppData\Local\Temp\_wd.mof"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2200
- C:\Windows\System32\Wbem\mofcomp.exe
  mofcomp.exe "C:\Users\Admin\AppData\Local\Temp\_ws.mof"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1584
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn \Microsoft\Windows\WindowsUpdate\AutoUpdate /tr C:\Users\Admin\AppData\Local\AppXCache\dllhost64.exe /sc ONLOGON /ru SYSTEM /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2932

C:\Users\Admin\AppData\Local\AppXCache\dllhost64.exe
C:\Users\Admin\AppData\Local\AppXCache\dllhost64.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1140

C:\ProgramData\Microsoft\WinAppVerifier\dllhost64.exe
C:\ProgramData\Microsoft\WinAppVerifier\dllhost64.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

System Information Discovery

T1082

System Network Connections Discovery

T1049

Virtualization/Sandbox Evasion