Analysis
-
max time kernel
271s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
16-03-2023 18:27
Behavioral task
behavioral1
Sample
Akira.exe
Resource
win10-20230220-en
Behavioral task
behavioral2
Sample
Akira.exe
Resource
win7-20230220-en
General
-
Target
Akira.exe
-
Size
5.1MB
-
MD5
47feab24e4a7a088fcac9a7067cbf318
-
SHA1
bbe0dcbe7eb3d0fa19b4afb5edff51b7066ec45d
-
SHA256
53285fb142e48bd1a568509c8997067370ac4578b3c92d8c3bc75ecdebc2915f
-
SHA512
6b3b0e289d06839cfd32327dfa1795368601a789c3dc2a0db9f0cce01001a28a584d5c26ce4e46e9002626a1f3ba318e038578e86f00cff489956aace8b419aa
-
SSDEEP
98304:KxNeg5VPsVXSfJHbM+A+PoudLZ1uRhkuoxa4kReiX2+jli:TgTZhHbFddNZ1kroxacUbBi
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
Akira.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Akira.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Akira.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Akira.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Akira.exe -
Processes:
resource yara_rule behavioral3/memory/4376-133-0x00007FF696030000-0x00007FF696BD5000-memory.dmp themida behavioral3/memory/4376-134-0x00007FF696030000-0x00007FF696BD5000-memory.dmp themida behavioral3/memory/4376-135-0x00007FF696030000-0x00007FF696BD5000-memory.dmp themida behavioral3/memory/4376-136-0x00007FF696030000-0x00007FF696BD5000-memory.dmp themida behavioral3/memory/4376-137-0x00007FF696030000-0x00007FF696BD5000-memory.dmp themida behavioral3/memory/4376-138-0x00007FF696030000-0x00007FF696BD5000-memory.dmp themida behavioral3/memory/4376-139-0x00007FF696030000-0x00007FF696BD5000-memory.dmp themida behavioral3/memory/4376-140-0x00007FF696030000-0x00007FF696BD5000-memory.dmp themida behavioral3/memory/4376-141-0x00007FF696030000-0x00007FF696BD5000-memory.dmp themida behavioral3/memory/4376-145-0x00007FF696030000-0x00007FF696BD5000-memory.dmp themida behavioral3/memory/4376-148-0x00007FF696030000-0x00007FF696BD5000-memory.dmp themida behavioral3/memory/4376-149-0x00007FF696030000-0x00007FF696BD5000-memory.dmp themida behavioral3/memory/4376-150-0x00007FF696030000-0x00007FF696BD5000-memory.dmp themida behavioral3/memory/4376-153-0x00007FF696030000-0x00007FF696BD5000-memory.dmp themida behavioral3/memory/4376-159-0x00007FF696030000-0x00007FF696BD5000-memory.dmp themida behavioral3/memory/4376-165-0x00007FF696030000-0x00007FF696BD5000-memory.dmp themida -
Processes:
Akira.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Akira.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
Akira.exepid process 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe -
Modifies registry class 9 IoCs
Processes:
Akira.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\discord-997338449747120159\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Akira.exe" Akira.exe Set value (str) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\discord-997338449747120159\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Akira.exe" Akira.exe Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\discord-997338449747120159\DefaultIcon Akira.exe Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\discord-997338449747120159\shell\open\command Akira.exe Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\discord-997338449747120159\shell Akira.exe Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\discord-997338449747120159\shell\open Akira.exe Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\discord-997338449747120159 Akira.exe Set value (str) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\discord-997338449747120159\ = "URL:Run game 997338449747120159 protocol" Akira.exe Set value (str) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\discord-997338449747120159\URL Protocol Akira.exe -
Suspicious behavior: EnumeratesProcesses 58 IoCs
Processes:
Akira.exepid process 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe 4376 Akira.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Akira.exepid process 4376 Akira.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Akira.exepid process 4376 Akira.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Akira.execmd.exedescription pid process target process PID 4376 wrote to memory of 1916 4376 Akira.exe cmd.exe PID 4376 wrote to memory of 1916 4376 Akira.exe cmd.exe PID 1916 wrote to memory of 4164 1916 cmd.exe certutil.exe PID 1916 wrote to memory of 4164 1916 cmd.exe certutil.exe PID 1916 wrote to memory of 3212 1916 cmd.exe find.exe PID 1916 wrote to memory of 3212 1916 cmd.exe find.exe PID 1916 wrote to memory of 3860 1916 cmd.exe find.exe PID 1916 wrote to memory of 3860 1916 cmd.exe find.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Akira.exe"C:\Users\Admin\AppData\Local\Temp\Akira.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Akira.exe" MD5 | find /i /v "md5" | find /i /v "certutil"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\certutil.execertutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Akira.exe" MD53⤵
-
C:\Windows\system32\find.exefind /i /v "certutil"3⤵
-
C:\Windows\system32\find.exefind /i /v "md5"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4376-133-0x00007FF696030000-0x00007FF696BD5000-memory.dmpFilesize
11.6MB
-
memory/4376-134-0x00007FF696030000-0x00007FF696BD5000-memory.dmpFilesize
11.6MB
-
memory/4376-135-0x00007FF696030000-0x00007FF696BD5000-memory.dmpFilesize
11.6MB
-
memory/4376-136-0x00007FF696030000-0x00007FF696BD5000-memory.dmpFilesize
11.6MB
-
memory/4376-137-0x00007FF696030000-0x00007FF696BD5000-memory.dmpFilesize
11.6MB
-
memory/4376-138-0x00007FF696030000-0x00007FF696BD5000-memory.dmpFilesize
11.6MB
-
memory/4376-139-0x00007FF696030000-0x00007FF696BD5000-memory.dmpFilesize
11.6MB
-
memory/4376-140-0x00007FF696030000-0x00007FF696BD5000-memory.dmpFilesize
11.6MB
-
memory/4376-141-0x00007FF696030000-0x00007FF696BD5000-memory.dmpFilesize
11.6MB
-
memory/4376-145-0x00007FF696030000-0x00007FF696BD5000-memory.dmpFilesize
11.6MB
-
memory/4376-148-0x00007FF696030000-0x00007FF696BD5000-memory.dmpFilesize
11.6MB
-
memory/4376-149-0x00007FF696030000-0x00007FF696BD5000-memory.dmpFilesize
11.6MB
-
memory/4376-150-0x00007FF696030000-0x00007FF696BD5000-memory.dmpFilesize
11.6MB
-
memory/4376-153-0x00007FF696030000-0x00007FF696BD5000-memory.dmpFilesize
11.6MB
-
memory/4376-159-0x00007FF696030000-0x00007FF696BD5000-memory.dmpFilesize
11.6MB
-
memory/4376-165-0x00007FF696030000-0x00007FF696BD5000-memory.dmpFilesize
11.6MB