Analysis
-
max time kernel
127s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
13/09/2024, 07:44
Static task
static1
Behavioral task
behavioral1
Sample
Akemi-Stealer-main.jar
Resource
win7-20240903-en
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Akemi-Stealer-main.jar
Resource
win10v2004-20240802-en
3 signatures
150 seconds
General
-
Target
Akemi-Stealer-main.jar
-
Size
11.4MB
-
MD5
a7bae5eda0a8bd8bb5ef01bb689e268c
-
SHA1
7bf8d1c607de0cba65dcc6a46435b351d4949326
-
SHA256
6eb67a3853f0bd6c4254e78750174cc29dd045477ca29393845d618fb70eacdf
-
SHA512
53ed080e5c23786dc41f971e3892e7c431b9e826820793ac3f4302764bc804425da11d6ee5a4ca462d4696b7a09d3bf0f7eb0a1110c2db44684c2d365e260b44
-
SSDEEP
196608:Sji+UV2/QDpBZMzL3qQNW5G92xgL9g1VOGK7y3drkiLK6O:Sji+oqQD5MvxU5m2xg6PTtj8
Score
6/10
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
flow ioc 14 discord.com 15 discord.com 31 discord.com 46 discord.com 55 discord.com -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4848 java.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4848 wrote to memory of 2116 4848 java.exe 96 PID 4848 wrote to memory of 2116 4848 java.exe 96 PID 4848 wrote to memory of 2196 4848 java.exe 99 PID 4848 wrote to memory of 2196 4848 java.exe 99
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\Akemi-Stealer-main.jar1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c dir2⤵PID:2116
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c dir2⤵PID:2196
-