2f25bdb328e22f9cd0336839e9aded37b2ff225fe99fa6b0746c02fe59e799a1

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 15:01

Target
2026-07-28_e681576fbfa0e8bebe934bbd0e102947_akira_quasar-rat.exe
Size 913KB
Sample260728-sdwlsszvb1
SHA256 2f25bdb328e22f9cd0336839e9aded37b2ff225fe99fa6b0746c02fe59e799a1
MD5 e681576fbfa0e8bebe934bbd0e102947
SHA1 6dc899c222969976cea0ea63a7293f7d99cc5189
SHA512 4b8fcb9d635e8de599bda25205859bd06eed802c3bde8abe6fa0fe17a1ea25f1e8785e43b4be58a5311d3c2302fe796d227651eb042e67e2b94e334d02172d6e
SSDEEP 24576:djB+SSqXrvrGUR6PY1JYhqRf9tDqO+9jlKxrRCK:ZBYqXQc9tDF+98R7
TLSH
T1BB159D87F5E751BCD26BC07483669A73FA31F84901107EBB56E4CB303D62E906B18B69
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2232 set thread context of 4772	2232	2026-07-28_e681576fbfa0e8bebe934bbd0e102947_akira_quasar-rat.exe	88

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 4772	2232	2026-07-28_e681576fbfa0e8bebe934bbd0e102947_akira_quasar-rat.exe	88
PID 2232 wrote to memory of 4772	2232	2026-07-28_e681576fbfa0e8bebe934bbd0e102947_akira_quasar-rat.exe	88
PID 2232 wrote to memory of 4772	2232	2026-07-28_e681576fbfa0e8bebe934bbd0e102947_akira_quasar-rat.exe	88
PID 2232 wrote to memory of 4772	2232	2026-07-28_e681576fbfa0e8bebe934bbd0e102947_akira_quasar-rat.exe	88
PID 2232 wrote to memory of 4772	2232	2026-07-28_e681576fbfa0e8bebe934bbd0e102947_akira_quasar-rat.exe	88
PID 2232 wrote to memory of 4772	2232	2026-07-28_e681576fbfa0e8bebe934bbd0e102947_akira_quasar-rat.exe	88
PID 2232 wrote to memory of 4772	2232	2026-07-28_e681576fbfa0e8bebe934bbd0e102947_akira_quasar-rat.exe	88
PID 2232 wrote to memory of 4772	2232	2026-07-28_e681576fbfa0e8bebe934bbd0e102947_akira_quasar-rat.exe	88
PID 2232 wrote to memory of 4772	2232	2026-07-28_e681576fbfa0e8bebe934bbd0e102947_akira_quasar-rat.exe	88
PID 2232 wrote to memory of 4772	2232	2026-07-28_e681576fbfa0e8bebe934bbd0e102947_akira_quasar-rat.exe	88
PID 2232 wrote to memory of 4772	2232	2026-07-28_e681576fbfa0e8bebe934bbd0e102947_akira_quasar-rat.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-28_e681576fbfa0e8bebe934bbd0e102947_akira_quasar-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_e681576fbfa0e8bebe934bbd0e102947_akira_quasar-rat.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  PID:4772

memory/2232-3-0x00007FF6044B0000-0x00007FF60459B000-memory.dmp

Download

memory/4772-0-0x00007FF773F00000-0x00007FF773F4B000-memory.dmp

Download