Overview
overview
7Static
static
7Akuma/lib/...ad.exe
windows10-2004-x64
1Akuma/lib/...ad.exe
windows10-2004-x64
1Akuma/lib/...er.exe
windows10-2004-x64
7Akuma/lib/cmdbkg.exe
windows10-2004-x64
1Akuma/lib/cmdwiz.exe
windows10-2004-x64
1Akuma/lib/...za.dll
windows10-2004-x64
1Akuma/lib/...za.exe
windows10-2004-x64
1Akuma/lib/...xa.dll
windows10-2004-x64
1Akuma/lib/...ad.exe
windows10-2004-x64
1Akuma/lib/...ad.exe
windows10-2004-x64
1Akuma/lib/...er.exe
windows10-2004-x64
7Akuma/lib/...kg.exe
windows10-2004-x64
1Akuma/lib/...iz.exe
windows10-2004-x64
1Akuma/lib/...za.dll
windows10-2004-x64
1Akuma/lib/...za.exe
windows10-2004-x64
1Akuma/lib/...xa.dll
windows10-2004-x64
1Akuma/lib/...za.dll
windows10-2004-x64
3Akuma/lib/...za.exe
windows10-2004-x64
1Akuma/lib/...xa.dll
windows10-2004-x64
3Akuma/lib/...ox.exe
windows10-2004-x64
3Akuma/lib/...ox.exe
windows10-2004-x64
3Akuma/lib/...ad.exe
windows10-2004-x64
1Akuma/lib/...ad.exe
windows10-2004-x64
1Akuma/lib/...er.exe
windows10-2004-x64
7Akuma/lib/...kg.exe
windows10-2004-x64
1Akuma/lib/...iz.exe
windows10-2004-x64
1Akuma/lib/...rl.exe
windows10-2004-x64
1Akuma/lib/...rl.exe
windows10-2004-x64
1Akuma/lib/...td.exe
windows10-2004-x64
7Akuma/lib/...64.exe
windows10-2004-x64
7Akuma/lib/...86.exe
windows10-2004-x64
7Akuma/lib/...rl.exe
windows10-2004-x64
1Analysis
-
max time kernel
92s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26/06/2024, 19:15
Behavioral task
behavioral1
Sample
Akuma/lib/binread/x64/binread.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral2
Sample
Akuma/lib/binread/x86/binread.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
Akuma/lib/bookmarks_parser.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral4
Sample
Akuma/lib/cmdbkg.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
Akuma/lib/cmdwiz.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral6
Sample
Akuma/lib/speak/7za/x64/7za.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
Akuma/lib/speak/7za/x64/7za.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral8
Sample
Akuma/lib/speak/7za/x64/7zxa.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral9
Sample
Akuma/lib/speak/binread/x64/binread.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral10
Sample
Akuma/lib/speak/binread/x86/binread.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
Akuma/lib/speak/bookmarks_parser.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral12
Sample
Akuma/lib/speak/cmdbkg.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
Akuma/lib/speak/cmdwiz.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral14
Sample
Akuma/lib/speak/curl/7za/x64/7za.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral15
Sample
Akuma/lib/speak/curl/7za/x64/7za.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral16
Sample
Akuma/lib/speak/curl/7za/x64/7zxa.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
Akuma/lib/speak/curl/7za/x86/7za.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral18
Sample
Akuma/lib/speak/curl/7za/x86/7za.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral19
Sample
Akuma/lib/speak/curl/7za/x86/7zxa.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral20
Sample
Akuma/lib/speak/curl/OpenFileBox.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
Akuma/lib/speak/curl/SaveFileBox.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral22
Sample
Akuma/lib/speak/curl/binread/x64/binread.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral23
Sample
Akuma/lib/speak/curl/binread/x86/binread.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral24
Sample
Akuma/lib/speak/curl/bookmarks_parser.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
Akuma/lib/speak/curl/cmdbkg.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral26
Sample
Akuma/lib/speak/curl/cmdwiz.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
Akuma/lib/speak/curl/curl/x64/curl.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral28
Sample
Akuma/lib/speak/curl/curl/x86/curl.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral29
Sample
Akuma/lib/speak/curl/speak/extd.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral30
Sample
Akuma/lib/speak/curl/speak/x64/speak-x64.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
Akuma/lib/speak/curl/speak/x86/speak-x86.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral32
Sample
Akuma/lib/speak/curl/x64/curl.exe
Resource
win10v2004-20240611-en
General
-
Target
Akuma/lib/speak/bookmarks_parser.exe
-
Size
4.9MB
-
MD5
0024fb2a8b21fd0b100b4569fb2db2de
-
SHA1
e0e29770b67a8462849fb8e550a50ee802a9591e
-
SHA256
a1be50e4f27588775579853e450b80495a8e54b441ac0d1bb289eecc595674b2
-
SHA512
1dbe968ce41b783aa2f916a6a7fa1d34a1e82552cdff300d0ce449f1afdba28fd7bc81cb785f9ec5417edf6aaa428d4d2007208876fb4f130e3ede188865c7b7
-
SSDEEP
98304:PWZpdAeYVH917pxX+T5zCTZT6FQ/C3QnVDZhWwA7r3vsQBaWlhTV5qc5k+QH:ejAeEPK9C6Q/OQVtQw2r3vpEcLIc
Malware Config
Signatures
-
Loads dropped DLL 5 IoCs
pid Process 3848 bookmarks_parser.exe 3848 bookmarks_parser.exe 3848 bookmarks_parser.exe 3848 bookmarks_parser.exe 3848 bookmarks_parser.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3084 wrote to memory of 3848 3084 bookmarks_parser.exe 80 PID 3084 wrote to memory of 3848 3084 bookmarks_parser.exe 80 PID 3084 wrote to memory of 3848 3084 bookmarks_parser.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\Akuma\lib\speak\bookmarks_parser.exe"C:\Users\Admin\AppData\Local\Temp\Akuma\lib\speak\bookmarks_parser.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\Akuma\lib\speak\bookmarks_parser.exe"C:\Users\Admin\AppData\Local\Temp\Akuma\lib\speak\bookmarks_parser.exe"2⤵
- Loads dropped DLL
PID:3848
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
81KB
MD55116fd80399d5af500badb186c866cde
SHA18dfbcdd296383aebc039058101aac1ae408e5152
SHA2561e5dc86e122379740724621890a1ba1b18252c745631a6dff862aa7723a1f99a
SHA512e41b71380fa49743f1efcc920276dbf1b2f7f5db5771f64a4d2ff18039c124efdb3b7d3fa66eda2c47b21012abe1186eade388b38dcaa7e8417707be546c65d4
-
Filesize
70KB
MD569571f3b3b8a1101515e4aee7f080cd1
SHA167cbcbac47499b15a60343b67a80cd16c4a9c197
SHA2567a9c1b992529281ffc38944580dd858e85d4a76620c768839fb7fb7c21771989
SHA5125b110ce65a93e03205fc4bac5fb2c83e3f67aae1e84a1d5503589ce43e843c29a31379c013e43533c84e70c0a82e5db8fbe63a678e20b8cefa515199bc599c6d
-
Filesize
137KB
MD576677f460125603976656f78b8af6b56
SHA10664d710ef55f5c58178ce44c185a4c0ad10a31a
SHA256a8f71849e92ef2455488b5a9334bd0c378b92f75b089b3eddb284c0ca545060a
SHA51260a8d0c95553700ad5c18f4c5fc5475e22c8d42ccbe7bc26530649695e18cecf2202c55bd4c7d3a943a018f6737b9ef262f52cf75c5e8df63d72eca40fcff442
-
Filesize
1008KB
MD53c39f09efc25551e8d79d60ac23d205c
SHA1c965fc04fbf09de3cf012dd8171c707d717da537
SHA25652e1825807e78e761671a757848e3eac5f1c19fd26b1e238846b4086d0b01809
SHA51263323c079dd880058c3a1af8c6dd6df969d3b662a358b1b09273c401cd7cf2e0c1dbfa6cf65b5df201aaaa11c46188a2e13ec909cdfd8e1263cb1b129ddd06ab
-
Filesize
3.5MB
MD521af5002786204a0fce0ebab2643f12a
SHA1b9920ca2c11205186e77b8d35021137c474abe91
SHA256d65d664fca161565b20e114a6b6ddb0cec7cfcb7d6f04d431fd64cdbeeed48b7
SHA51276ed9de199ac156853126ea74016dead74a14223fdf9688bb7cf2be191caa76c70fcc4d8577264b98f386270b56a83454636581bf06f7f905e8ca1dea6386cbf
-
Filesize
893KB
MD5a924b24d71829da17e8908e05a5321e4
SHA1fa5c69798b997c34c87a8b32130f664cdef8c124
SHA256f32a61d91264aff96efd719915bed80785a8db4c8d881d6da28909b620fe466f
SHA5129223ec0e6e0f70b92473e897e4fd4635a19e9ca3aff2fe7c5c065764b58e86460442991787525ed53e425ecd36f2881a6df34c35d2a0e21b7ac4bc61bf1cbeab