Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
20/08/2026, 02:21
General
- Target 2026-08-20_e92f9c7f94ee54ca55a3efcf146ea1ec_glassworm_qilin_quasar-rat.exe
- Size 16.2MB
- Sample260820-cs1ajaba48
- SHA256 7c9541b7fa210acbb05364e6c5ccb549572f0b8586a0ab3a12b022081d59db8c
Score
10/10
Malware Config
Signatures
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
- Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
- Detects command variations typically used by ransomware 1 IoCs
- Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r 1 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
- Detects executables referencing many IR and analysis tools 1 IoCs
- Detects executables using Telegram Chat Bot 1 IoCs
- Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
- Looks for VMWare services registry key. 1 TTPs 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_e92f9c7f94ee54ca55a3efcf146ea1ec_glassworm_qilin_quasar-rat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_e92f9c7f94ee54ca55a3efcf146ea1ec_glassworm_qilin_quasar-rat.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Enumerates VirtualBox registry keys
- Looks for VMWare services registry key.
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1888-2-0x00007FF6FF070000-0x00007FF6FFE59000-memory.dmp