d6702a3576de4f0b69c0a439bf9a358d8e4fefef127a3123afa7b6f13cdc87dd

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 22:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-02_ca2eabc52d164f61d0d0343f8443b1e7_akira_glassworm_quasar-rat.exe
Size 3.4MB
Sample261102-2prawsfy3k
SHA256 d6702a3576de4f0b69c0a439bf9a358d8e4fefef127a3123afa7b6f13cdc87dd
MD5 ca2eabc52d164f61d0d0343f8443b1e7
SHA1 6bbefa9a99d350929cb137e57befc44bb0265f0e
SHA512 2893a7c8b6a3e5f315e025d41d9595b428d1bf95cf5c906fca4e604d0de1e21cc109987b31d335d205bcc50a32d80e486dd2403e4e5225bea7f107b257ef71e2
SSDEEP 49152:we1Xo4BSDEoPsp5MktJCodbLy7zwtXWiHXFLvGnTnHwKrBefIU6isKNE:wnXE5ZEEXRvGbxIw+s1
TLSH
T1FBF54B43F6A681EDC0ADC1788356A233F732B88D493077AB2BE44B312E56B519F4D719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery

Malware Config

Signatures

Detects command variations typically used by ransomware 1 IoCs

resource	yara_rule
behavioral2/memory/2204-4-0x00007FF6C4230000-0x00007FF6C459B000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware

Hide Artifacts: Hidden Files and Directories 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5948	cmd.exe
4100	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-02_ca2eabc52d164f61d0d0343f8443b1e7_akira_glassworm_quasar-rat.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 5948	2204	2026-11-02_ca2eabc52d164f61d0d0343f8443b1e7_akira_glassworm_quasar-rat.exe	90
PID 2204 wrote to memory of 4100	2204	2026-11-02_ca2eabc52d164f61d0d0343f8443b1e7_akira_glassworm_quasar-rat.exe	91
PID 5948 wrote to memory of 3788	5948	cmd.exe	94
PID 4100 wrote to memory of 4408	4100	cmd.exe	95

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3788	attrib.exe
4408	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-11-02_ca2eabc52d164f61d0d0343f8443b1e7_akira_glassworm_quasar-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-02_ca2eabc52d164f61d0d0343f8443b1e7_akira_glassworm_quasar-rat.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\system32\cmd.exe
  "cmd" /C attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\.z3rsm
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:5948
- - C:\Windows\system32\attrib.exe
    attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\.z3rsm
    3⤵
    - Views/modifies file attributes
    PID:3788
- C:\Windows\system32\cmd.exe
  "cmd" /C attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\.z3rsm
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4100
- - C:\Windows\system32\attrib.exe
    attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\.z3rsm
    3⤵
    - Views/modifies file attributes
    PID:4408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.z3rsm

Path C:\Users\Admin\AppData\Roaming\Microsoft\.z3rsm
Size 479B
SHA256 2e720a4f8e52488f6bba86a48aa4a8a038f5d385e105ce447ace596fcda200e5
MD5 ecb8ff31a0715643906f5eab89182113
SHA1 effb6d0cb3a2fb7aaa07d7a5643e46bdb22cbfc9
SHA512 a7bc77459ead05eef57c4663e3bb5368089b86d5398b870160549db97cb25c6b3c73d59af7afda051bc7e0c1e18d434a9250858c0c5adc4a8b215dd4cfa5f2a4
TLSH
T10FF0D4D079A83211C60AF9C9CD575E7E944165DBB0918524B8D5006B79C17023B974A7
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2204-4-0x00007FF6C4230000-0x00007FF6C459B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads