Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
04/06/2026, 19:58
General
- Target 2026-06-04_e14cd1fb18721fc64abb9b1a6cd42e7c_akira_cobalt-strike_glassworm_quasar-rat.exe
- Size 1.5MB
- Sample260604-yp968adw5y
- SHA256 1b13637243584aabde16bb9c604a9f3e1aa067880b70861ed7c71f9784f4980e
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs
Run Powershell and hide display window.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-04_e14cd1fb18721fc64abb9b1a6cd42e7c_akira_cobalt-strike_glassworm_quasar-rat.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-04_e14cd1fb18721fc64abb9b1a6cd42e7c_akira_cobalt-strike_glassworm_quasar-rat.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -NonInteractive -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\TradingView\""2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -NonInteractive -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\TradingView\""2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -NonInteractive -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\""2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_wrfr04py.dh1.ps1
memory/1328-63-0x000001B4B5770000-0x000001B4B6232000-memory.dmp
memory/1328-61-0x000001B4B6510000-0x000001B4B65C3000-memory.dmp
memory/4564-47-0x000001F5CF1D0000-0x000001F5CFC92000-memory.dmp
memory/5604-78-0x00007FF6B8E30000-0x00007FF6B8FAD000-memory.dmp
memory/5604-65-0x00007FF6B8E30000-0x00007FF6B8FAD000-memory.dmp
memory/5604-64-0x000002C71FBE0000-0x000002C71FC5D000-memory.dmp
memory/5604-0-0x000002C71FBE0000-0x000002C71FC5D000-memory.dmp
memory/6088-18-0x00000222F66B0000-0x00000222F66CC000-memory.dmp
memory/6088-21-0x00000222F6350000-0x00000222F635A000-memory.dmp
memory/6088-24-0x00000222F6730000-0x00000222F674A000-memory.dmp
memory/6088-27-0x00000222F6720000-0x00000222F672A000-memory.dmp
memory/6088-26-0x00000222F6710000-0x00000222F6716000-memory.dmp
memory/6088-25-0x00000222F66E0000-0x00000222F66E8000-memory.dmp
memory/6088-30-0x00000222F55A0000-0x00000222F6062000-memory.dmp
memory/6088-31-0x00000222F55A0000-0x00000222F6062000-memory.dmp
memory/6088-22-0x00000222F66F0000-0x00000222F670C000-memory.dmp
memory/6088-23-0x00000222F66D0000-0x00000222F66DA000-memory.dmp
memory/6088-20-0x00000222F55A0000-0x00000222F6062000-memory.dmp
memory/6088-19-0x00000222F6770000-0x00000222F6823000-memory.dmp
memory/6088-11-0x00000222F55A0000-0x00000222F6062000-memory.dmp
memory/6088-10-0x00000222F55A0000-0x00000222F6062000-memory.dmp
memory/6088-9-0x00000222F55A0000-0x00000222F6062000-memory.dmp
memory/6088-4-0x00000222F6310000-0x00000222F6332000-memory.dmp
memory/6088-1-0x00000222F5D6A000-0x00000222F5D6B000-memory.dmp