Analysis
- max time kernel
148s - max time network
120s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
09/07/2026, 03:44
General
- Target 2026-07-09_a3e7e1d11f8b68b9f1f28c4b246e7a36_akira_quasar-rat.exe
- Size 1.2MB
- Sample260709-eaqdqact5q
- SHA256 098d503a53d8b607b9acfa3e5896b0f7e4cf9cf0a3e77ec46c532d6d9812976c
Malware Config
Signatures
- Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_a3e7e1d11f8b68b9f1f28c4b246e7a36_akira_quasar-rat.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_a3e7e1d11f8b68b9f1f28c4b246e7a36_akira_quasar-rat.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -EncodedCommand UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0AVgBlAHIAYgAgAFIAdQBuAEEAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADIAMAAyADYALQAwADcALQAwADkAXwBhADMAZQA3AGUAMQBkADEAMQBmADgAYgA2ADgAYgA5AGYAMQBmADIAOABjADQAYgAyADQANgBlADcAYQAzADYAXwBhAGsAaQByAGEAXwBxAHUAYQBzAGEAcgAtAHIAYQB0AC4AZQB4AGUAJwAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAnAC0ALQBlAGwAZQB2AGEAdABlAGQAJwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4A2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_a3e7e1d11f8b68b9f1f28c4b246e7a36_akira_quasar-rat.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_a3e7e1d11f8b68b9f1f28c4b246e7a36_akira_quasar-rat.exe" --elevated3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exe"reg" query r\"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{00000000-0000-0000-0000-000000000000}4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/972-0-0x00007FF6872A0000-0x00007FF6873DA000-memory.dmp
memory/2840-1-0x00007FFD0AB8F000-0x00007FFD0AB90000-memory.dmp
memory/2840-2-0x00007FFD0AA00000-0x00007FFD0B3A4000-memory.dmp
memory/2840-3-0x000001F09B8D0000-0x000001F09B8F2000-memory.dmp
memory/2840-4-0x00007FFD0AA00000-0x00007FFD0B3A4000-memory.dmp
memory/2840-7-0x00007FFD0AA00000-0x00007FFD0B3A4000-memory.dmp
memory/2840-8-0x00007FFD0AA00000-0x00007FFD0B3A4000-memory.dmp
memory/2840-9-0x00007FFD0AA00000-0x00007FFD0B3A4000-memory.dmp
memory/2840-10-0x00007FFD0AA00000-0x00007FFD0B3A4000-memory.dmp
memory/2840-11-0x00007FFD0AA00000-0x00007FFD0B3A4000-memory.dmp
memory/2840-14-0x00007FFD0AA00000-0x00007FFD0B3A4000-memory.dmp
memory/2840-13-0x00007FFD0AA00000-0x00007FFD0B3A4000-memory.dmp
memory/6120-15-0x00007FF6872A0000-0x00007FF6873DA000-memory.dmp
memory/6120-23-0x00007FF6872A0000-0x00007FF6873DA000-memory.dmp