Analysis
- max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 00:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-07_d592f9ad25dfdf8fb1d42e2607c76377_akira_quasar-rat.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-07_d592f9ad25dfdf8fb1d42e2607c76377_akira_quasar-rat.exe
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
General
- Target 2026-08-07_d592f9ad25dfdf8fb1d42e2607c76377_akira_quasar-rat.exe
- Size 35.1MB
- Sample260808-aye6fay1c1
- SHA256 51d7de00a4bd101ae7328040274356b585fea3bb7568dcf332cc2b30c7f5e202
- MD5 d592f9ad25dfdf8fb1d42e2607c76377
- SHA1 0760ae8f01eacc0ba30656a1d657a406cc2d22e3
- SHA512 91158d51a3e8d7dc71fc9e5a6e8d0a48c2eb4d92f49821aa0c51a6b28c144612e2f2bed3eece0336b727c6b8aa7fad310e7a4bf4607ff74dc3071800a9a82be0
- SSDEEP 393216:nkPWc51x6EjxzQzpPxRZGsoKxDsXp2V1v:nkPWc51x6EjxzQzpPxRZGsoMDsXp2VJ
- TLSH T10A878CB2AD9647E0C6A38A3B487E452D4775231AFF06E7624C1C8F769E872C4DE1270D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 5676 loader.exe - Executes dropped EXE 1 IoCs
pid Process 5676 loader.exe - Modifies registry class 7 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\loader\ = "URL:Loader Protocol" 2026-08-07_d592f9ad25dfdf8fb1d42e2607c76377_akira_quasar-rat.exe Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\loader\URL Protocol 2026-08-07_d592f9ad25dfdf8fb1d42e2607c76377_akira_quasar-rat.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\loader\shell\open\command 2026-08-07_d592f9ad25dfdf8fb1d42e2607c76377_akira_quasar-rat.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\loader\shell 2026-08-07_d592f9ad25dfdf8fb1d42e2607c76377_akira_quasar-rat.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\loader\shell\open 2026-08-07_d592f9ad25dfdf8fb1d42e2607c76377_akira_quasar-rat.exe Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\loader\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\loader\\loader.exe\" \"%1\"" 2026-08-07_d592f9ad25dfdf8fb1d42e2607c76377_akira_quasar-rat.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\loader 2026-08-07_d592f9ad25dfdf8fb1d42e2607c76377_akira_quasar-rat.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3428 wrote to memory of 5676 3428 2026-08-07_d592f9ad25dfdf8fb1d42e2607c76377_akira_quasar-rat.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_d592f9ad25dfdf8fb1d42e2607c76377_akira_quasar-rat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_d592f9ad25dfdf8fb1d42e2607c76377_akira_quasar-rat.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Roaming\loader\loader.exe"C:\Users\Admin\AppData\Roaming\loader\loader.exe" --cleanup C:\Users\Admin\AppData\Local\Temp\2026-08-07_d592f9ad25dfdf8fb1d42e2607c76377_akira_quasar-rat.exe2⤵
- Deletes itself
- Executes dropped EXE
PID:5676
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\loader\loader.exe
- Size 35.1MB
- SHA256 51d7de00a4bd101ae7328040274356b585fea3bb7568dcf332cc2b30c7f5e202
- MD5 d592f9ad25dfdf8fb1d42e2607c76377
- SHA1 0760ae8f01eacc0ba30656a1d657a406cc2d22e3
- SHA512 91158d51a3e8d7dc71fc9e5a6e8d0a48c2eb4d92f49821aa0c51a6b28c144612e2f2bed3eece0336b727c6b8aa7fad310e7a4bf4607ff74dc3071800a9a82be0
- SSDEEP 393216:nkPWc51x6EjxzQzpPxRZGsoKxDsXp2V1v:nkPWc51x6EjxzQzpPxRZGsoMDsXp2VJ
- TLSH T10A878CB2AD9647E0C6A38A3B487E452D4775231AFF06E7624C1C8F769E872C4DE1270D
- MD5 SHA1 SHA512 SSDEEP TLSH