Overview

overview

9

Static

static

3

2026-07-02...ra.exe

windows10-2004-x64

9

2026-07-02...ra.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/07/2026, 16:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-02_d4852a019a6431ae79c49e60f5102f18_akira.exe
  • Size 8.0MB
  • Sample260702-txbleaex6k
  • SHA256 40ef3051c9531cf5843450bc4239b9c4bb51e57b753b5e33cafcc662d7fcaa68
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwarecredential_accessdefense_evasiondiscoverypersistenceransomwarespywarestealer

Malware Config

Signatures

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 4 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 4 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 4 IoCs
  • Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 4 IoCs
  • Reads ssh keys stored on the system 2 TTPs

    Tries to access SSH used by SSH programs.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
    defense_evasion
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 40 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 40 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 45 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-02_d4852a019a6431ae79c49e60f5102f18_akira.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-02_d4852a019a6431ae79c49e60f5102f18_akira.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:5416
    • C:\Users\Admin\AppData\Local\Temp\system_diag.exe
      "C:\Users\Admin\AppData\Local\Temp\system_diag.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5804
      • C:\Users\Admin\AppData\Local\Temp\elv_73333cd8-ecc9-444a-84fc-09c192015677.exe
        "C:\Users\Admin\AppData\Local\Temp\elv_73333cd8-ecc9-444a-84fc-09c192015677.exe" chrome -o temp_abe_output\chrome -v -f
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:5684
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe"
          4⤵
            PID:628
        • C:\Users\Admin\AppData\Local\Temp\elv_73333cd8-ecc9-444a-84fc-09c192015677.exe
          "C:\Users\Admin\AppData\Local\Temp\elv_73333cd8-ecc9-444a-84fc-09c192015677.exe" edge -o temp_abe_output\edge -v -f
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1248
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
            4⤵
              PID:2680
          • C:\Users\Admin\AppData\Local\Temp\elv_73333cd8-ecc9-444a-84fc-09c192015677.exe
            "C:\Users\Admin\AppData\Local\Temp\elv_73333cd8-ecc9-444a-84fc-09c192015677.exe" brave -o temp_abe_output\brave -v -f
            3⤵
            • Executes dropped EXE
            PID:2044
          • C:\Windows\system32\systeminfo.exe
            "systeminfo"
            3⤵
            • Gathers system information
            PID:5584
          • C:\Windows\system32\tasklist.exe
            "tasklist"
            3⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:5436
          • C:\Windows\system32\cmd.exe
            "cmd" /C C:\Users\Admin\AppData\Local\Temp\sd_60fcc35b-bb3c-4cca-92ff-2f692f28b2ae.bat
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:5596
            • C:\Windows\system32\chcp.com
              chcp 65001
              4⤵
                PID:4240
              • C:\Windows\system32\timeout.exe
                timeout /t 1 /nobreak
                4⤵
                • Delays execution with timeout.exe
                PID:3176
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c tasklist /fi "IMAGENAME eq system_diag*" /fo csv | findstr /i "system_diag"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:6120
                • C:\Windows\system32\tasklist.exe
                  tasklist /fi "IMAGENAME eq system_diag*" /fo csv
                  5⤵
                  • Enumerates processes with tasklist
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4908
                • C:\Windows\system32\findstr.exe
                  findstr /i "system_diag"
                  5⤵
                    PID:5932
                • C:\Windows\system32\timeout.exe
                  timeout /t 2 /nobreak
                  4⤵
                  • Delays execution with timeout.exe
                  PID:2592
          • C:\Windows\System32\rundll32.exe
            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
            1⤵
              PID:572
            • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
              "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
              1⤵
                PID:4108
              • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                1⤵
                  PID:944
                • C:\Windows\system32\sihost.exe
                  sihost.exe
                  1⤵
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of WriteProcessMemory
                  PID:1708
                  • C:\Windows\explorer.exe
                    explorer.exe /LOADSAVEDWINDOWS
                    2⤵
                    • Boot or Logon Autostart Execution: Active Setup
                    • Enumerates connected drives
                    • Checks SCSI registry key(s)
                    • Modifies Internet Explorer settings
                    • Modifies registry class
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    • Suspicious use of SetWindowsHookEx
                    PID:5352
                • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                  1⤵
                  • Modifies registry class
                  • Suspicious use of SetWindowsHookEx
                  PID:5772
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                  • Modifies registry class
                  • Suspicious use of SetWindowsHookEx
                  PID:3100

                Network

                      MITRE ATT&CK Enterprise v16

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      STEALER_DEBUG.TXT
                      • Path C:\USERS\ADMIN\DESKTOP\STEALER_DEBUG.TXT
                      • Size 9KB
                      • SHA256 90f92b437ab1731b264ef9555a345d76ac44dc2fdd93391d6de035d45251e252
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      prep_Activatable Class_Hermes_perf.cache
                      • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                      • Size 599B
                      • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      elv_73333cd8-ecc9-444a-84fc-09c192015677.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\elv_73333cd8-ecc9-444a-84fc-09c192015677.exe
                      • Size 1.4MB
                      • SHA256 671cdb4073a267455050b240df9bafbcf857db2052c578a899ac91707c3bef16
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      sd_60fcc35b-bb3c-4cca-92ff-2f692f28b2ae.bat
                      • Path C:\Users\Admin\AppData\Local\Temp\sd_60fcc35b-bb3c-4cca-92ff-2f692f28b2ae.bat
                      • Size 756B
                      • SHA256 9ba3d872c95e5e44087817e4f8e82e7cc3632e498d3b5120e47b1ac4088f355e
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      system_diag.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\system_diag.exe
                      • Size 7.7MB
                      • SHA256 8325827b4ab4fd43d8fbad5a57698a376e1786dfcda66ded46279f0151445671
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      stealer_debug.txt
                      • Path C:\Users\Admin\Desktop\stealer_debug.txt
                      • Size 485B
                      • SHA256 07456e30a2efc326de5045593e784facd2f158a962d481ec29908de69f591140
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      stealer_debug.txt
                      • Path C:\Users\Admin\Desktop\stealer_debug.txt
                      • Size 3KB
                      • SHA256 e6728d81fde14ba0bcb464a43d4a669a6b122abb57e2b1e52161ad35e8acbeec
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      stealer_debug.txt
                      • Path C:\Users\Admin\Desktop\stealer_debug.txt
                      • Size 3KB
                      • SHA256 21238850cd4e8835984a5a35f01bd0e2532bab1d92dad9a3b3079d55239eb6e3
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      stealer_debug.txt
                      • Path C:\Users\Admin\Desktop\stealer_debug.txt
                      • Size 5KB
                      • SHA256 941664ea4652235eda1c6531d100c0d2e9b7fadf3985798d54c6fee9d393031e
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      stealer_debug.txt
                      • Path C:\Users\Admin\Desktop\stealer_debug.txt
                      • Size 1KB
                      • SHA256 1feacf17444056b272d355820cb17f7f34710d029668427b25d281f977dc307b
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      stealer_debug.txt
                      • Path C:\Users\Admin\Desktop\stealer_debug.txt
                      • Size 1KB
                      • SHA256 4d4f8580718e60629b6aeac1d926418dc46891e7c535facc2835442924fc6a61
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      stealer_debug.txt
                      • Path C:\Users\Admin\Desktop\stealer_debug.txt
                      • Size 2KB
                      • SHA256 c0e6dfad7b5f3b1c9561f05f0a32a4b25d6b6c808358db3211de78cd7d3c1e1a
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      BACKUP_LOG.txt
                      • Path C:\Users\Admin\logs\BACKUP_LOG.txt
                      • Size 2KB
                      • SHA256 f2908837c732b6434832f611d5fe15da6ca91bfa3d158b4c7a7aec9ea12a0053
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      BACKUP_LOG.txt
                      • Path C:\Users\Admin\logs\BACKUP_LOG.txt
                      • Size 5KB
                      • SHA256 6e9a8d0cf90bbfaf353497ef586b5e52b0b851344fc71b32b8310ec953b3885c
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      BACKUP_LOG.txt
                      • Path C:\Users\Admin\logs\BACKUP_LOG.txt
                      • Size 985B
                      • SHA256 61491cecd3fce5225950e48f843d72b544000bffaa8b5fd296d9fda348063798
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      BACKUP_LOG.txt
                      • Path C:\Users\Admin\logs\BACKUP_LOG.txt
                      • Size 1KB
                      • SHA256 935ed906ba6db78d237da809381da129cfee39d60374f03bfb45b4297140ffbe
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      BACKUP_LOG.txt
                      • Path C:\Users\Admin\logs\BACKUP_LOG.txt
                      • Size 1KB
                      • SHA256 b1d87ac0a293be3b694f7835580f98ceff801844be5ccd25e073e8bd54728d65
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      stealer_early_debug.txt
                      • Path C:\Users\Admin\stealer_early_debug.txt
                      • Size 331B
                      • SHA256 fc24f251fd5c86f102bb042bce633f4af1a927c940fb8df8a64cd77f13aff341
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      fingerprint.json
                      • Path C:\Users\Admin\temp_abe_output\chrome\Chrome\fingerprint.json
                      • Size 868B
                      • SHA256 3cfa00baa85da51b97203a259ab67892ac534467af45b05937ec483180e39082
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      memory/5416-227-0x00007FF7DD7E0000-0x00007FF7DDFE3000-memory.dmp
                      Download

                      memory/5416-559-0x00007FF7DD7E0000-0x00007FF7DDFE3000-memory.dmp
                      Download

                      memory/5772-331-0x0000027C001E0000-0x0000027C002E0000-memory.dmp
                      Download

                      memory/5772-348-0x0000027C03E70000-0x0000027C03F70000-memory.dmp
                      Download

                      memory/5772-333-0x0000027C001E0000-0x0000027C002E0000-memory.dmp
                      Download

                      memory/5772-382-0x0000027C04210000-0x0000027C04230000-memory.dmp
                      Download

                      memory/5772-356-0x0000027C03C90000-0x0000027C03CB0000-memory.dmp
                      Download

                      memory/5772-347-0x0000027C03A30000-0x0000027C03A50000-memory.dmp
                      Download

                      memory/5772-332-0x0000027C001E0000-0x0000027C002E0000-memory.dmp
                      Download

                      memory/5804-327-0x00007FF73E740000-0x00007FF73EEED000-memory.dmp
                      Download

                      memory/5804-235-0x00007FF73E740000-0x00007FF73EEED000-memory.dmp
                      Download

                      memory/5804-558-0x00007FF73E740000-0x00007FF73EEED000-memory.dmp
                      Download