ccf94c48c55f30f8aa8e8d82db7315eb8167bc5ecd6257a95ee1800ced39d701

Analysis

max time kernel
148s
max time network
143s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/05/2026, 04:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-18_4d394e96e1bdf34e3163946a06df546d_akira.exe
Size 14.7MB
Sample260518-evesqabv9r
SHA256 ccf94c48c55f30f8aa8e8d82db7315eb8167bc5ecd6257a95ee1800ced39d701
MD5 4d394e96e1bdf34e3163946a06df546d
SHA1 4cd18b40cbbd4ab3796931eae82237d1e9a1dcc9
SHA512 db5cc574a764fae3ec7a9c939836a89b8597b7a93aab9b3e1bacde04a7ece401a80ec31359f868a3d8fa76ac3193f06260939926f0255d55cbe43dfa621b429a
SSDEEP 49152:rpMH87iFCHLaJ9gq8srdYRvb/OI5P611SYCW1qpLutfAo2Ob0C38ktuatrbKZpJa:i
TLSH
T18DF64DE49C4CECE90EC95E95ED0F7BEC627516E3CF1660A3983ECF444D6A36AD111A02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2788 created 3172	2788	RuntimeBroker.exe	54

Loads dropped DLL 1 IoCs

pid	Process
4860	chrome.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
3	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1408 set thread context of 2788	1408	2026-05-18_4d394e96e1bdf34e3163946a06df546d_akira.exe	81

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
960	cmd.exe
5088	PING.EXE

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RuntimeBroker.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5088	PING.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2788	RuntimeBroker.exe
2788	RuntimeBroker.exe
2788	RuntimeBroker.exe
2788	RuntimeBroker.exe
2788	RuntimeBroker.exe
2788	RuntimeBroker.exe
2788	RuntimeBroker.exe
2788	RuntimeBroker.exe
2788	RuntimeBroker.exe
2788	RuntimeBroker.exe
2788	RuntimeBroker.exe
2788	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 2788	1408	2026-05-18_4d394e96e1bdf34e3163946a06df546d_akira.exe	81
PID 1408 wrote to memory of 2788	1408	2026-05-18_4d394e96e1bdf34e3163946a06df546d_akira.exe	81
PID 1408 wrote to memory of 2788	1408	2026-05-18_4d394e96e1bdf34e3163946a06df546d_akira.exe	81
PID 1408 wrote to memory of 2788	1408	2026-05-18_4d394e96e1bdf34e3163946a06df546d_akira.exe	81
PID 1408 wrote to memory of 2788	1408	2026-05-18_4d394e96e1bdf34e3163946a06df546d_akira.exe	81
PID 1408 wrote to memory of 2788	1408	2026-05-18_4d394e96e1bdf34e3163946a06df546d_akira.exe	81
PID 1408 wrote to memory of 2788	1408	2026-05-18_4d394e96e1bdf34e3163946a06df546d_akira.exe	81
PID 1408 wrote to memory of 2788	1408	2026-05-18_4d394e96e1bdf34e3163946a06df546d_akira.exe	81
PID 1408 wrote to memory of 2788	1408	2026-05-18_4d394e96e1bdf34e3163946a06df546d_akira.exe	81
PID 1408 wrote to memory of 2788	1408	2026-05-18_4d394e96e1bdf34e3163946a06df546d_akira.exe	81
PID 1408 wrote to memory of 2788	1408	2026-05-18_4d394e96e1bdf34e3163946a06df546d_akira.exe	81
PID 2788 wrote to memory of 4860	2788	RuntimeBroker.exe	83
PID 2788 wrote to memory of 960	2788	RuntimeBroker.exe	86
PID 960 wrote to memory of 5088	960	cmd.exe	88

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3172
- C:\Users\Admin\AppData\Local\Temp\2026-05-18_4d394e96e1bdf34e3163946a06df546d_akira.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-05-18_4d394e96e1bdf34e3163946a06df546d_akira.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1408
- - C:\Windows\System32\RuntimeBroker.exe
    "C:\Windows\System32\RuntimeBroker.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2788
  - - C:\Windows\System32\cmd.exe
      "cmd" /C ping localhost -n 2 > nul & del /F /Q C:\Windows\System32\RuntimeBroker.exe
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Suspicious use of WriteProcessMemory
      PID:960
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --disable-software-rasterizer
  2⤵
  - Loads dropped DLL
  PID:4860

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2288

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

55446DAC.tmp

Path C:\Users\Admin\AppData\Local\Temp\55446DAC.tmp
Size 4.9MB
SHA256 5b3c4af0b9e97e8d617a7d1953802fa3047d1ec943a73da682074163e8fc34cb
MD5 aa015f186553011a1c470291eafd094b
SHA1 b76060efeb81d0ffb7fe0293517cfc5671b948b0
SHA512 24e758e57647379eaf2d621978c798283f1104ab8636111bdb8abb031fde73c31db3e35b6182993a96e3297f6cb3f0696817364299afd41c55b5e706a923fae4
SSDEEP 49152:/sgV3VaHPZ8j3vzH94RP3/qRmmdrwJOvcxqM8gFmwZy5xPyVH+T4+MLXumzdv2bF:0DPQBzZE0M8gQRfnT+cj
TLSH
T155368D03E29581EDD4AFC179CB479732AA36F4891630B69F27D5D7203E26F905B0E728
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cookies.json

Path C:\Users\Admin\AppData\Local\Temp\Kurion-Result\Browser\Chromium\Chrome\Default\cookies.json
Size 384B
SHA256 9a368b62a15b328598505283c830540a36242a2ce06e776d9b3f16731eda938e
MD5 308131a1fc048ba2a5447eacbc3d5f9f
SHA1 7766bcd72bc79530060befea655893c7d44bef90
SHA512 c5ad889d0b9a1b5fc959d533a0cffd255fa9f237f38f85758a6ce70392815d311bb14c219e077dbd4a04a0aaeb798223831db6afa8026bcd5c8eedd7277d7ce8
TLSH
T1FAE0F1E5E8F65C3F8804505480A0189E70106003D8C83E21764080DF4F44A3FF63B3E4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1408-11-0x00007FF73CAB0000-0x00007FF73D963000-memory.dmp

Download

memory/2788-126-0x00007FF751A30000-0x00007FF7521E5000-memory.dmp

Download

memory/2788-131-0x00007FF751A30000-0x00007FF7521E5000-memory.dmp

Download

memory/2788-121-0x00007FF751A30000-0x00007FF7521E5000-memory.dmp

Download

memory/2788-119-0x00007FF751A30000-0x00007FF7521E5000-memory.dmp

Download

memory/2788-128-0x00007FF751A30000-0x00007FF7521E5000-memory.dmp

Download

memory/2788-0-0x00007FF751A30000-0x00007FF7521E5000-memory.dmp

Download

memory/2788-129-0x00007FF751A30000-0x00007FF7521E5000-memory.dmp

Download

memory/2788-124-0x00007FF751A30000-0x00007FF7521E5000-memory.dmp

Download

memory/2788-125-0x00007FF751A30000-0x00007FF7521E5000-memory.dmp

Download

memory/2788-138-0x00007FF751A30000-0x00007FF7521E5000-memory.dmp

Download

memory/2788-127-0x00007FF751A30000-0x00007FF7521E5000-memory.dmp

Download

memory/2788-123-0x00007FF751A30000-0x00007FF7521E5000-memory.dmp

Download

memory/2788-122-0x00007FF751A30000-0x00007FF7521E5000-memory.dmp

Download

memory/2788-120-0x00007FF751A30000-0x00007FF7521E5000-memory.dmp

Download

memory/2788-118-0x00007FF751A30000-0x00007FF7521E5000-memory.dmp

Download

memory/2788-156-0x00007FF751A30000-0x00007FF7521E5000-memory.dmp

Download