3201dfb64a02baf99207ce649156c8b8a4963f60e929c32d36d33994d1f5bb1b

Analysis

max time kernel
150s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 17:06

Target
2026-07-11_0f8ffd3872a0779706150ee0a70fe0cf_akira_cobalt-strike_quasar-rat.exe
Size 450KB
Sample260711-vmfcaahw6s
SHA256 3201dfb64a02baf99207ce649156c8b8a4963f60e929c32d36d33994d1f5bb1b
MD5 0f8ffd3872a0779706150ee0a70fe0cf
SHA1 8d896d6a2e091bce1d3d19f71f839571f3b0fe0e
SHA512 cc4350cf5cb9f1e1e72cea08fa2d56eb36af1463cf2724bcba8edbd856eb391800a19e71e1949e539eb67fcfd86dfeec9c246bafaec87545798fa7acb3052a89
SSDEEP 6144:ZDu+/cISMS37kRbGvrnRhJNwkqqZq6KtRsoXIxN6C1rQbxvHlupbWeGs:ZDu+E3wRavdJqqZq6KtioXIOcsvMqeG
TLSH
T102A46C47B6B552BFC35BCC74834A9673BA73F48A022069BB02E4863C2E55F156F1EB14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

Disable or Modify System Firewall

pid	Process
5656	netsh.exe
1800	netsh.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4756	2026-07-11_0f8ffd3872a0779706150ee0a70fe0cf_akira_cobalt-strike_quasar-rat.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4756	2026-07-11_0f8ffd3872a0779706150ee0a70fe0cf_akira_cobalt-strike_quasar-rat.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 5656	4756	2026-07-11_0f8ffd3872a0779706150ee0a70fe0cf_akira_cobalt-strike_quasar-rat.exe	86
PID 4756 wrote to memory of 1800	4756	2026-07-11_0f8ffd3872a0779706150ee0a70fe0cf_akira_cobalt-strike_quasar-rat.exe	88