8ce7df16f577d8f7ccc5b549338803536f2b5ebc5ded82f903285947f7bec3e6

Analysis

max time kernel
150s
max time network
92s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 09:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-28_f7e82e14c2ce4b7cd8c2c025fa81080c_akira.exe
Size 9.0MB
Sample260528-ltql6act5p
SHA256 8ce7df16f577d8f7ccc5b549338803536f2b5ebc5ded82f903285947f7bec3e6
MD5 f7e82e14c2ce4b7cd8c2c025fa81080c
SHA1 c756871ef1cdbbf783f9fa776cc5a28912cca584
SHA512 cde060eb6811aacf0ecbb26223cd5cda36e2b21ccc9bd7825c1ca0ec74088383d6da1240ad268f7ba66698af2e9311483b075463f0feda23a7fc22acb7b0f4c5
SSDEEP 24576:2jpEOsC0BYv64G5N2n57qUE2o0kAlZJ7teZ0XsUHbYCt+MTkYaPAxCXxyKZArhv4:2VMt
TLSH
T1A296BFB876047DE6F66F567BDA96ACED03B626238ACBA4CD406477C30563371FE02805
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2160 created 3248	2160	RuntimeBroker.exe	54

Loads dropped DLL 1 IoCs

pid	Process
2276	chrome.exe

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	api.ipify.org
1	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3680 set thread context of 2160	3680	2026-05-28_f7e82e14c2ce4b7cd8c2c025fa81080c_akira.exe	81

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2196	cmd.exe
1612	PING.EXE

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RuntimeBroker.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1612	PING.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2160	RuntimeBroker.exe
2160	RuntimeBroker.exe
2160	RuntimeBroker.exe
2160	RuntimeBroker.exe
2160	RuntimeBroker.exe
2160	RuntimeBroker.exe
2160	RuntimeBroker.exe
2160	RuntimeBroker.exe
2160	RuntimeBroker.exe
2160	RuntimeBroker.exe
2160	RuntimeBroker.exe
2160	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3680 wrote to memory of 2160	3680	2026-05-28_f7e82e14c2ce4b7cd8c2c025fa81080c_akira.exe	81
PID 3680 wrote to memory of 2160	3680	2026-05-28_f7e82e14c2ce4b7cd8c2c025fa81080c_akira.exe	81
PID 3680 wrote to memory of 2160	3680	2026-05-28_f7e82e14c2ce4b7cd8c2c025fa81080c_akira.exe	81
PID 3680 wrote to memory of 2160	3680	2026-05-28_f7e82e14c2ce4b7cd8c2c025fa81080c_akira.exe	81
PID 3680 wrote to memory of 2160	3680	2026-05-28_f7e82e14c2ce4b7cd8c2c025fa81080c_akira.exe	81
PID 3680 wrote to memory of 2160	3680	2026-05-28_f7e82e14c2ce4b7cd8c2c025fa81080c_akira.exe	81
PID 3680 wrote to memory of 2160	3680	2026-05-28_f7e82e14c2ce4b7cd8c2c025fa81080c_akira.exe	81
PID 3680 wrote to memory of 2160	3680	2026-05-28_f7e82e14c2ce4b7cd8c2c025fa81080c_akira.exe	81
PID 3680 wrote to memory of 2160	3680	2026-05-28_f7e82e14c2ce4b7cd8c2c025fa81080c_akira.exe	81
PID 3680 wrote to memory of 2160	3680	2026-05-28_f7e82e14c2ce4b7cd8c2c025fa81080c_akira.exe	81
PID 3680 wrote to memory of 2160	3680	2026-05-28_f7e82e14c2ce4b7cd8c2c025fa81080c_akira.exe	81
PID 2160 wrote to memory of 2276	2160	RuntimeBroker.exe	83
PID 2160 wrote to memory of 2196	2160	RuntimeBroker.exe	86
PID 2196 wrote to memory of 1612	2196	cmd.exe	88

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3248
- C:\Users\Admin\AppData\Local\Temp\2026-05-28_f7e82e14c2ce4b7cd8c2c025fa81080c_akira.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-05-28_f7e82e14c2ce4b7cd8c2c025fa81080c_akira.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3680
- - C:\Windows\System32\RuntimeBroker.exe
    "C:\Windows\System32\RuntimeBroker.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2160
  - - C:\Windows\System32\cmd.exe
      "cmd" /C ping localhost -n 2 > nul & del /F /Q C:\Windows\System32\RuntimeBroker.exe
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Suspicious use of WriteProcessMemory
      PID:2196
    - - C:\Windows\system32\PING.EXE
        
        ping localhost -n 2
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --disable-software-rasterizer
  2⤵
  - Loads dropped DLL
  PID:2276

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4508

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0690A2F0.tmp

Path C:\Users\Admin\AppData\Local\Temp\0690A2F0.tmp
Size 4.9MB
SHA256 c52a9f3053f64caa43e244be9b889ef6a663c56c5202304fe6f86a9282d67b2d
MD5 17716978653f645af52df9a18d745070
SHA1 8798794be55a3a434a13bc5342fd39aa3f154d64
SHA512 ad0d08cb9394a12a7bd1d40ee91d7cb64a5b5f1c1444d12bfa73fb9b0f623b9c74e9b0a3c3c7cbbcffa1701259c3628fbacc8232212b50161c75ef8ffd2be76c
SSDEEP 49152:BwgV3VaHPZ8j3vzH94RP3/qRmmdrwJOvcxqM8gFmwZy5xPyVH+Tt+MLXumzdv2bb:SDPQBzZE0M8gQRinT+c9
TLSH
T17F368D03E29581EDD4AFC179CB479732AA36F4891630B69F27D5D7203E26F905B0E728
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cookies.json

Path C:\Users\Admin\AppData\Local\Temp\Kurion-Result\Browser\Chromium\Chrome\Default\cookies.json
Size 383B
SHA256 14e3ab50c870c9eb210971df397f59a3c23069ecdd127daa76ef896d702cc399
MD5 afec4a3ad21ff73ee8d7042bf7ebe7cf
SHA1 0d4322bb8d7b2dd9f2cbdd2d6749e4e3e1efdf93
SHA512 93a6faa4c18b135c71db0addc470378362b2ed1cc39c621be782802d9db52f53be4140cbb434defdc10e1826fc057cb3f74f6f3a9d61d3ec69ce15c1b86641c8
TLSH
T11DE068A5F4E98C17D46C917099845845FF0060638A15FC96B291085FEF9892FF7E24CE
MD5 SHA1 SHA512 TLSH

Submit Download

~df367225A0.tmp

Path C:\Users\Admin\AppData\Local\Temp\~df367225A0.tmp
Size 1023KB
SHA256 184ee90f2c693ecca8294092d1ff58b515c75247c8894913624a539949085ea1
MD5 e03911c2bc76f141e8e3a0a116e5cd2c
SHA1 a36229f628193b19992c4f38902e8d9608b3da3b
SHA512 a29425cd39fa50971847c4e0deaf29a15e90dc49c1a68710e07dd73f5e6266415c917527fb59384242c82f716f3440e9f5226cd8b3749aeecc17ee59e0f709f9
SSDEEP 12288:Yvzq3iIDQYqQMbxKgqg1GnCm6rIJnW4V3DVDc8ZEreO2Ep1phyuy3i94O4vHEQx1:Ymy7Hyg1B0JWm9c86U5DbWx+eK37
TLSH
T190253379E81D86D02032D42B9BD9A6BC1BF4E6ECFB4F18F9D42FDBE413650A61C15122
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2160-126-0x00007FF789190000-0x00007FF78994D000-memory.dmp

Download

memory/2160-127-0x00007FF789190000-0x00007FF78994D000-memory.dmp

Download

memory/2160-162-0x00007FF789190000-0x00007FF78994D000-memory.dmp

Download

memory/2160-131-0x00007FF789190000-0x00007FF78994D000-memory.dmp

Download

memory/2160-129-0x00007FF789190000-0x00007FF78994D000-memory.dmp

Download

memory/2160-133-0x00007FF789190000-0x00007FF78994D000-memory.dmp

Download

memory/2160-132-0x00007FF789190000-0x00007FF78994D000-memory.dmp

Download

memory/2160-130-0x00007FF789190000-0x00007FF78994D000-memory.dmp

Download

memory/2160-128-0x00007FF789190000-0x00007FF78994D000-memory.dmp

Download

memory/2160-135-0x00007FF789190000-0x00007FF78994D000-memory.dmp

Download

memory/2160-125-0x00007FF789190000-0x00007FF78994D000-memory.dmp

Download

memory/2160-123-0x00007FF789190000-0x00007FF78994D000-memory.dmp

Download

memory/2160-122-0x00007FF789190000-0x00007FF78994D000-memory.dmp

Download

memory/2160-120-0x00007FF789190000-0x00007FF78994D000-memory.dmp

Download

memory/2160-0-0x00007FF789190000-0x00007FF78994D000-memory.dmp

Download

memory/2160-124-0x00007FF789190000-0x00007FF78994D000-memory.dmp

Download

memory/2160-121-0x00007FF789190000-0x00007FF78994D000-memory.dmp

Download

memory/3596-118-0x000001A5A82D0000-0x000001A5A84F1000-memory.dmp

Download

memory/3680-13-0x00007FF6189E0000-0x00007FF6192DC000-memory.dmp

Download

memory/4508-117-0x000001DCBA4E0000-0x000001DCBA701000-memory.dmp

Download