22da90f8afe54635cec961313b4ae032af53c8781aa7c5ed2d4a0f2197d25335

Analysis

max time kernel
150s
max time network
137s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 16:03

Target
2026-06-04_5938b5578ef8f0258c40cf8463905dd4_akira_coinminer_glassworm_qakbot_quasar-rat.exe
Size 60.4MB
Sample260604-thm1wsav7t
SHA256 22da90f8afe54635cec961313b4ae032af53c8781aa7c5ed2d4a0f2197d25335
MD5 5938b5578ef8f0258c40cf8463905dd4
SHA1 b43f25a994fa0aa855a28747b350aee3f833df6b
SHA512 b1f1b5c92f6e071229aee4450511a6380096fd039110e1c6f8ab4ff3b74b5f0b82e20650d2a02a93128fc8a727046683398c8990609486efb853710807f602e8
SSDEEP 393216:Qd43zWwOCR2QY4qyNegsE+s/Ezf7Kq1qO+PNIwxfALYKFdu9CwJsv6t1LJq1q:Qd4fZOaOXbOq1qN9ALMLJq1q
TLSH
T157D77C03E29250EDD5BFD231875BA732FA31B8895334AA9F1554D7212E31FA0AB3E714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1228	2026-06-04_5938b5578ef8f0258c40cf8463905dd4_akira_coinminer_glassworm_qakbot_quasar-rat.exe
1228	2026-06-04_5938b5578ef8f0258c40cf8463905dd4_akira_coinminer_glassworm_qakbot_quasar-rat.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1228	2026-06-04_5938b5578ef8f0258c40cf8463905dd4_akira_coinminer_glassworm_qakbot_quasar-rat.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3488	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3488	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1228	2026-06-04_5938b5578ef8f0258c40cf8463905dd4_akira_coinminer_glassworm_qakbot_quasar-rat.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 5080	1228	2026-06-04_5938b5578ef8f0258c40cf8463905dd4_akira_coinminer_glassworm_qakbot_quasar-rat.exe	81

C:\Users\Admin\AppData\Local\Temp\2026-06-04_5938b5578ef8f0258c40cf8463905dd4_akira_coinminer_glassworm_qakbot_quasar-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_5938b5578ef8f0258c40cf8463905dd4_akira_coinminer_glassworm_qakbot_quasar-rat.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Users\Admin\AppData\Local\Temp\2026-06-04_5938b5578ef8f0258c40cf8463905dd4_akira_coinminer_glassworm_qakbot_quasar-rat.exe
  C:\Users\Admin\AppData\Local\Temp\2026-06-04_5938b5578ef8f0258c40cf8463905dd4_akira_coinminer_glassworm_qakbot_quasar-rat.exe
  2⤵
  PID:5080

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004E8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3488