Analysis
- max time kernel
150s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
11/07/2026, 10:49
General
- Target 2026-07-11_82e13f407fd65e58efabe50072c878bf_akira_coinminer_glassworm_qakbot_quasar-rat.exe
- Size 69.1MB
- Sample260711-mwwfvsav4x
- SHA256 b2779020f39fb0f047cfa18c55580f6c3e854177a8750175efe7c15b23d22ff4
Score
9/10
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 11 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-11_82e13f407fd65e58efabe50072c878bf_akira_coinminer_glassworm_qakbot_quasar-rat.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-11_82e13f407fd65e58efabe50072c878bf_akira_coinminer_glassworm_qakbot_quasar-rat.exe"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-11_82e13f407fd65e58efabe50072c878bf_akira_coinminer_glassworm_qakbot_quasar-rat.exeC:\Users\Admin\AppData\Local\Temp\2026-07-11_82e13f407fd65e58efabe50072c878bf_akira_coinminer_glassworm_qakbot_quasar-rat.exe2⤵
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x000000000000050C 0x00000000000005141⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2712-0-0x00007FF7B4740000-0x00007FF7B8DB4000-memory.dmp
memory/3500-4-0x00007FF7B4740000-0x00007FF7B8DB4000-memory.dmp
memory/3500-5-0x00007FF7B4740000-0x00007FF7B8DB4000-memory.dmp
memory/3500-7-0x00007FF7B4740000-0x00007FF7B8DB4000-memory.dmp
memory/3500-10-0x00007FF7B4740000-0x00007FF7B8DB4000-memory.dmp
memory/3500-11-0x00007FF7B4740000-0x00007FF7B8DB4000-memory.dmp
memory/3500-12-0x00007FF7B4740000-0x00007FF7B8DB4000-memory.dmp
memory/3500-13-0x00007FF7B4740000-0x00007FF7B8DB4000-memory.dmp
memory/3500-14-0x00007FF7B4740000-0x00007FF7B8DB4000-memory.dmp
memory/3500-15-0x00007FF7B4740000-0x00007FF7B8DB4000-memory.dmp
memory/3500-16-0x00007FF7B4740000-0x00007FF7B8DB4000-memory.dmp