Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
10/11/2026, 23:57
General
- Target 2026-11-09_2bec4dfdbf12403e7c7a58e4d337f6aa_akira_glassworm_rusty-stealer.exe
- Size 12.6MB
- Sample261110-3zmacscf59
- SHA256 e513b737dd99e3fa398944987b8285450160de2446645bf6d28899231f4975fa
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 16 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 64 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-09_2bec4dfdbf12403e7c7a58e4d337f6aa_akira_glassworm_rusty-stealer.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-09_2bec4dfdbf12403e7c7a58e4d337f6aa_akira_glassworm_rusty-stealer.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\runcell-pyexe\06792e3f179a6808801db9bcb5416a66\python\python.exe"C:\Users\Admin\AppData\Local\runcell-pyexe\06792e3f179a6808801db9bcb5416a66\python\python.exe" C:\Users\Admin\AppData\Local\runcell-pyexe\06792e3f179a6808801db9bcb5416a66\app/final.py2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c title Windows System Optimizer3⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-Type -Name Window -Namespace Console -MemberDefinition '[DllImport(\"Kernel32.dll\")] public static extern IntPtr GetConsoleWindow(); [DllImport(\"user32.dll\")] public static extern bool ShowWindow(IntPtr hWnd, Int32 nCmdShow);'; [Console.Window]::ShowWindow([Console.Window]::GetConsoleWindow(), 0)"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\sarteqzn\sarteqzn.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES59AA.tmp" "c:\Users\Admin\AppData\Local\Temp\sarteqzn\CSCEBC34B36CE3D47BE826D8254644E05F.TMP"5⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Set-ItemProperty -Path \"HKCU:\Software\Microsoft\Windows\CurrentVersion\Run\" -Name \"SysOptUpdate\" -Value \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinUpdate.exe\""3⤵
- Command and Scripting Interpreter: PowerShell
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
RES59AA.tmp
__PSScriptPolicyTest_onqpdykf.eoj.ps1
sarteqzn.dll
final.py
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_bz2.pyd
_hashlib.pyd
_lzma.pyd
_socket.pyd
_ssl.pyd
_wmi.pyd
_zstd.pyd
libcrypto-3.dll
libssl-3.dll
python.exe
python3.DLL
python314._pth
python314.dll
python314.zip
unicodedata.pyd
CSCEBC34B36CE3D47BE826D8254644E05F.TMP
sarteqzn.0.cs
sarteqzn.cmdline
memory/4164-86-0x000001A2CF6D0000-0x000001A2CF6F2000-memory.dmp
memory/4352-108-0x00007FFD55F40000-0x00007FFD568E4000-memory.dmp
memory/4352-96-0x00007FFD55F40000-0x00007FFD568E4000-memory.dmp
memory/4352-102-0x00007FFD55F40000-0x00007FFD568E4000-memory.dmp
memory/4352-103-0x00007FFD55F40000-0x00007FFD568E4000-memory.dmp
memory/4352-104-0x00007FFD55F40000-0x00007FFD568E4000-memory.dmp
memory/4352-105-0x00007FFD55F40000-0x00007FFD568E4000-memory.dmp
memory/4352-106-0x00007FFD55F40000-0x00007FFD568E4000-memory.dmp
memory/4352-107-0x00007FFD55F40000-0x00007FFD568E4000-memory.dmp
memory/4352-101-0x00007FFD55F40000-0x00007FFD568E4000-memory.dmp
memory/4352-90-0x00007FFD55F40000-0x00007FFD568E4000-memory.dmp
memory/4352-100-0x00007FFD55F40000-0x00007FFD568E4000-memory.dmp
memory/4352-122-0x0000015542DC0000-0x0000015542DC8000-memory.dmp
memory/4352-89-0x00007FFD55F40000-0x00007FFD568E4000-memory.dmp
memory/4352-124-0x00007FFD55F40000-0x00007FFD568E4000-memory.dmp
memory/4352-80-0x00007FFD560CF000-0x00007FFD560D0000-memory.dmp
memory/4352-88-0x00007FFD55F40000-0x00007FFD568E4000-memory.dmp
memory/4672-120-0x000001BC791D0000-0x000001BC79B74000-memory.dmp