ccf94c48c55f30f8aa8e8d82db7315eb8167bc5ecd6257a95ee1800ced39d701

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/05/2026, 04:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-18_4d394e96e1bdf34e3163946a06df546d_akira.exe
Size 14.7MB
Sample260518-evesqabv9r
SHA256 ccf94c48c55f30f8aa8e8d82db7315eb8167bc5ecd6257a95ee1800ced39d701
MD5 4d394e96e1bdf34e3163946a06df546d
SHA1 4cd18b40cbbd4ab3796931eae82237d1e9a1dcc9
SHA512 db5cc574a764fae3ec7a9c939836a89b8597b7a93aab9b3e1bacde04a7ece401a80ec31359f868a3d8fa76ac3193f06260939926f0255d55cbe43dfa621b429a
SSDEEP 49152:rpMH87iFCHLaJ9gq8srdYRvb/OI5P611SYCW1qpLutfAo2Ob0C38ktuatrbKZpJa:i
TLSH
T18DF64DE49C4CECE90EC95E95ED0F7BEC627516E3CF1660A3983ECF444D6A36AD111A02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4492 created 3280	4492	RuntimeBroker.exe	56

Loads dropped DLL 1 IoCs

pid	Process
3300	chrome.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
19	api.ipify.org
20	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4336 set thread context of 4492	4336	2026-05-18_4d394e96e1bdf34e3163946a06df546d_akira.exe	87

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
652	PING.EXE
412	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RuntimeBroker.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
652	PING.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4492	RuntimeBroker.exe
4492	RuntimeBroker.exe
4492	RuntimeBroker.exe
4492	RuntimeBroker.exe
4492	RuntimeBroker.exe
4492	RuntimeBroker.exe
4492	RuntimeBroker.exe
4492	RuntimeBroker.exe
4492	RuntimeBroker.exe
4492	RuntimeBroker.exe
4492	RuntimeBroker.exe
4492	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4336 wrote to memory of 4492	4336	2026-05-18_4d394e96e1bdf34e3163946a06df546d_akira.exe	87
PID 4336 wrote to memory of 4492	4336	2026-05-18_4d394e96e1bdf34e3163946a06df546d_akira.exe	87
PID 4336 wrote to memory of 4492	4336	2026-05-18_4d394e96e1bdf34e3163946a06df546d_akira.exe	87
PID 4336 wrote to memory of 4492	4336	2026-05-18_4d394e96e1bdf34e3163946a06df546d_akira.exe	87
PID 4336 wrote to memory of 4492	4336	2026-05-18_4d394e96e1bdf34e3163946a06df546d_akira.exe	87
PID 4336 wrote to memory of 4492	4336	2026-05-18_4d394e96e1bdf34e3163946a06df546d_akira.exe	87
PID 4336 wrote to memory of 4492	4336	2026-05-18_4d394e96e1bdf34e3163946a06df546d_akira.exe	87
PID 4336 wrote to memory of 4492	4336	2026-05-18_4d394e96e1bdf34e3163946a06df546d_akira.exe	87
PID 4336 wrote to memory of 4492	4336	2026-05-18_4d394e96e1bdf34e3163946a06df546d_akira.exe	87
PID 4336 wrote to memory of 4492	4336	2026-05-18_4d394e96e1bdf34e3163946a06df546d_akira.exe	87
PID 4336 wrote to memory of 4492	4336	2026-05-18_4d394e96e1bdf34e3163946a06df546d_akira.exe	87
PID 4492 wrote to memory of 3300	4492	RuntimeBroker.exe	91
PID 4492 wrote to memory of 412	4492	RuntimeBroker.exe	96
PID 412 wrote to memory of 652	412	cmd.exe	98

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3280
- C:\Users\Admin\AppData\Local\Temp\2026-05-18_4d394e96e1bdf34e3163946a06df546d_akira.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-05-18_4d394e96e1bdf34e3163946a06df546d_akira.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4336
- - C:\Windows\System32\RuntimeBroker.exe
    "C:\Windows\System32\RuntimeBroker.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4492
  - - C:\Windows\System32\cmd.exe
      "cmd" /C ping localhost -n 2 > nul & del /F /Q C:\Windows\System32\RuntimeBroker.exe
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Suspicious use of WriteProcessMemory
      PID:412
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --disable-software-rasterizer
  2⤵
  - Loads dropped DLL
  PID:3300

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2800

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

B06A3DDC.tmp

Path C:\Users\Admin\AppData\Local\Temp\B06A3DDC.tmp
Size 4.9MB
SHA256 5b3c4af0b9e97e8d617a7d1953802fa3047d1ec943a73da682074163e8fc34cb
MD5 aa015f186553011a1c470291eafd094b
SHA1 b76060efeb81d0ffb7fe0293517cfc5671b948b0
SHA512 24e758e57647379eaf2d621978c798283f1104ab8636111bdb8abb031fde73c31db3e35b6182993a96e3297f6cb3f0696817364299afd41c55b5e706a923fae4
SSDEEP 49152:/sgV3VaHPZ8j3vzH94RP3/qRmmdrwJOvcxqM8gFmwZy5xPyVH+T4+MLXumzdv2bF:0DPQBzZE0M8gQRfnT+cj
TLSH
T155368D03E29581EDD4AFC179CB479732AA36F4891630B69F27D5D7203E26F905B0E728
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cookies.json

Path C:\Users\Admin\AppData\Local\Temp\Kurion-Result\Browser\Chromium\Chrome\Default\cookies.json
Size 384B
SHA256 004ecd3d514e1f8e853b41927428fd1ea9281967833d86a6fae141a63b2eeba0
MD5 9d42f242fee720e50d29c599159b3a42
SHA1 f80550ba09635c856d72af93ebc4008d9471112e
SHA512 6fe98e4da1baf2bd1c7da2fe4dc602ce0136271ec2dcdb73154fbacfb74ca0674adee5da88b5249ab994b01db89778c4d232f36ad5a070e8c0a3c887704add8f
TLSH
T195E06869EAB74C33DA48971504A2144AA180D6139D05BD2B3AA1881EAE8CA1F79F21E4
MD5 SHA1 SHA512 TLSH

Submit Download

~df16FE921C.tmp

Path C:\Users\Admin\AppData\Local\Temp\~df16FE921C.tmp
Size 1023KB
SHA256 29bdf8400a09220bf2aa18ec900ca4f614bcded03f8860e0340c319742eada50
MD5 f844b48d27124e0908077ef00793a002
SHA1 c9d4e780a3c059f9f01ec3ad9a957154d08d5150
SHA512 4e0150bdaaae78ae25fae0e03c5aabe2b0e72691bb0e6022ae41b5d93de127eeb1f72cc4b1b5641da5c4edbc197d8e2ee29f01774644e80aa1afb1042f4ac458
SSDEEP 24576:hdR4VF0EOFw8oBbFUlNu4CkGmhqX1fWmyP0WtRRaUgFXsamWdzE6Q:hdUlIoBQE4naWfP9LRaUgzOn
TLSH
T1432533FE4B2067D1C7904CB6398D25383154C5A33A330278EBB72625A0D65FA9BF7C92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~df16FE921C.tmp

Path C:\Users\Admin\AppData\Local\Temp\~df16FE921C.tmp
Size 64KB
SHA256 fc60f1cc4c22dff6a9edf38148a462e316040e65eadf659134d254dfec23ad2f
MD5 122d2418e474da8ca26761f8da6d46f3
SHA1 5c92c6dcb8b2c7e703836d74b7209424a7260632
SHA512 0915b8f657186a2261ddc8564a5df22bd22a37452015ddf2008499056033730f39c64eeaf4371a7e10b6bc5472afba87c73908cfd8f5c5928368de82dbee7d21
SSDEEP 1536:N20XVlTyXWJtXByOUXEmYQKAQoS5CV3q+W2T:N22l2XMBBBMzvGsVJpT
TLSH
T14E5312EDAB7F67021DA9F242BE58116A6803105DFA3AA9C0D57A04B05E7FC3F1181AC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~df16FE921C.tmp

Path C:\Users\Admin\AppData\Local\Temp\~df16FE921C.tmp
Size 64KB
SHA256 e48c1c090f3f3c2432209afaa1e03540415b11e9f62c17d06a371ddd501ac324
MD5 6f036a8f1b29e167d01348aec0c6dc47
SHA1 e95722d75d8cde1436b79244bb18724ba3e13dd7
SHA512 5aaa62a955ecf018776573f7da4c06d733880383b2cccc2b8b9cd7b9da0e1107d0087fde8bcbc59b9c1528138e1a564d25df06de40c9d1b6f37439404604a865
SSDEEP 1536:ruSNyYTKdyHETn20b55eHnWxcnOTMH6tOAHJqHnlu:ruSvTKMHETnNzkOQCOAHJf
TLSH
T1F9531270E008D65B82E215D8F2DF3F2DEB41217BE952ED99EECA17F2C629B4891110CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4336-11-0x00007FF6718F0000-0x00007FF6727A3000-memory.dmp

Download

memory/4492-126-0x00007FF70F730000-0x00007FF70FEE5000-memory.dmp

Download

memory/4492-123-0x00007FF70F730000-0x00007FF70FEE5000-memory.dmp

Download

memory/4492-127-0x00007FF70F730000-0x00007FF70FEE5000-memory.dmp

Download

memory/4492-0-0x00007FF70F730000-0x00007FF70FEE5000-memory.dmp

Download

memory/4492-131-0x00007FF70F730000-0x00007FF70FEE5000-memory.dmp

Download

memory/4492-125-0x00007FF70F730000-0x00007FF70FEE5000-memory.dmp

Download

memory/4492-128-0x00007FF70F730000-0x00007FF70FEE5000-memory.dmp

Download

memory/4492-129-0x00007FF70F730000-0x00007FF70FEE5000-memory.dmp

Download

memory/4492-122-0x00007FF70F730000-0x00007FF70FEE5000-memory.dmp

Download

memory/4492-120-0x00007FF70F730000-0x00007FF70FEE5000-memory.dmp

Download

memory/4492-119-0x00007FF70F730000-0x00007FF70FEE5000-memory.dmp

Download

memory/4492-124-0x00007FF70F730000-0x00007FF70FEE5000-memory.dmp

Download

memory/4492-121-0x00007FF70F730000-0x00007FF70FEE5000-memory.dmp

Download

memory/4492-118-0x00007FF70F730000-0x00007FF70FEE5000-memory.dmp

Download

memory/4492-156-0x00007FF70F730000-0x00007FF70FEE5000-memory.dmp

Download