a405ae29b0ae8e418726a4370e876117fbcbf66137c98b7a35b7a9290dac7c01

General

Target
2026-08-11_0f6d5c814e677fc4fda8fafa82ddb6b3_akira_glassworm_rusty-stealer.exe
Size 1.4MB
Sample260812-bepffasyas
SHA256 a405ae29b0ae8e418726a4370e876117fbcbf66137c98b7a35b7a9290dac7c01
MD5 0f6d5c814e677fc4fda8fafa82ddb6b3
SHA1 75479158e6348c0fc91383ea1495aee08a08bc49
SHA512 9e93cf83e67ea1768f49a1b5c140a81aa7946f27ba0fdfe25c6a473f690cf21d73ff46d5fddccf475f682869439fed9c3bac689cdf1621f1e7c66b4c73c28013
SSDEEP 24576:g6zLFIKWgMchewuB30VPABfxDx4r7lEGmPdOmKxFM3VIH06iyKd:g6zxIKhh8Z0VYB9xklEG0GYIU6iFd
TLSH
T1D2658D03F651C1E9C4ADC478C7578532AA32BC8E0B3475EF27C4AA152E7AF906B2DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5560	winsvc.exe
2720	winsvc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinSvc = "C:\\Windows\\System32\\winsvc.exe"	reg.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\winsvc.exe	2026-08-11_0f6d5c814e677fc4fda8fafa82ddb6b3_akira_glassworm_rusty-stealer.exe

Modifies registry key 1 TTPs 7 IoCs

Modify Registry

T1112

pid	Process
248	reg.exe
832	reg.exe
3684	reg.exe
3896	reg.exe
5884	reg.exe
4224	reg.exe
6576	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5072	schtasks.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 248	4700	2026-08-11_0f6d5c814e677fc4fda8fafa82ddb6b3_akira_glassworm_rusty-stealer.exe	89
PID 4700 wrote to memory of 832	4700	2026-08-11_0f6d5c814e677fc4fda8fafa82ddb6b3_akira_glassworm_rusty-stealer.exe	91
PID 4700 wrote to memory of 3684	4700	2026-08-11_0f6d5c814e677fc4fda8fafa82ddb6b3_akira_glassworm_rusty-stealer.exe	93
PID 4700 wrote to memory of 5372	4700	2026-08-11_0f6d5c814e677fc4fda8fafa82ddb6b3_akira_glassworm_rusty-stealer.exe	95
PID 4700 wrote to memory of 5072	4700	2026-08-11_0f6d5c814e677fc4fda8fafa82ddb6b3_akira_glassworm_rusty-stealer.exe	97
PID 2720 wrote to memory of 3896	2720	winsvc.exe	104
PID 5560 wrote to memory of 5884	5560	winsvc.exe	103
PID 5560 wrote to memory of 4224	5560	winsvc.exe	107
PID 2720 wrote to memory of 6576	2720	winsvc.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-11_0f6d5c814e677fc4fda8fafa82ddb6b3_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_0f6d5c814e677fc4fda8fafa82ddb6b3_akira_glassworm_rusty-stealer.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Windows\system32\reg.exe
  "reg.exe" add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion /v _rs_test /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:248
- C:\Windows\system32\reg.exe
  "reg.exe" delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion /v _rs_test /f
  2⤵
  - Modifies registry key
  PID:832
- C:\Windows\system32\reg.exe
  "reg.exe" add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v WinSvc /t REG_SZ /d C:\Windows\System32\winsvc.exe /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:3684
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /query /tn WinSvc /fo csv /v
  2⤵
  PID:5372
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /create /tn WinSvc /xml C:\Users\Admin\AppData\Local\Temp\winsvc.xml /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5072

C:\Windows\System32\winsvc.exe
C:\\Windows\\System32\\winsvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Windows\System32\reg.exe
  "reg.exe" add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion /v _rs_test /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:3896
- C:\Windows\System32\reg.exe
  "reg.exe" delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion /v _rs_test /f
  2⤵
  - Modifies registry key
  PID:6576

C:\Windows\System32\winsvc.exe
C:\Windows\System32\winsvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5560
- C:\Windows\System32\reg.exe
  "reg.exe" add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion /v _rs_test /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:5884
- C:\Windows\System32\reg.exe
  "reg.exe" delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion /v _rs_test /f
  2⤵
  - Modifies registry key
  PID:4224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

winsvc.xml

Path C:\Users\Admin\AppData\Local\Temp\winsvc.xml
Size 2KB
SHA256 f5e89671c274be53801f9190dc9c324f23ed568e3f9a1de934cdf1f3500fdf18
MD5 eea284ded0a898e77a60424f0173f44f
SHA1 762beec7c7618b975ddc9d91b10c77c626972b9b
SHA512 e49dcb0b5ecd6bab68a6bd7c253cbf443950e3f0347105ae4f8280c43ac01b618a4edc45730ce91083a5d793c472618b4d5844aaf72fa0c496681743230f3978
TLSH
T13A41DF43A7FE1219F2F76FACBEB664418DB6FD456D24C8AD0060040D08B5970C9B0B3B
MD5 SHA1 SHA512 TLSH

Submit Download

winsvc.exe

Path C:\Windows\System32\winsvc.exe
Size 1.4MB
SHA256 a405ae29b0ae8e418726a4370e876117fbcbf66137c98b7a35b7a9290dac7c01
MD5 0f6d5c814e677fc4fda8fafa82ddb6b3
SHA1 75479158e6348c0fc91383ea1495aee08a08bc49
SHA512 9e93cf83e67ea1768f49a1b5c140a81aa7946f27ba0fdfe25c6a473f690cf21d73ff46d5fddccf475f682869439fed9c3bac689cdf1621f1e7c66b4c73c28013
SSDEEP 24576:g6zLFIKWgMchewuB30VPABfxDx4r7lEGmPdOmKxFM3VIH06iyKd:g6zxIKhh8Z0VYB9xklEG0GYIU6iFd
TLSH
T1D2658D03F651C1E9C4ADC478C7578532AA32BC8E0B3475EF27C4AA152E7AF906B2DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads