Analysis
- max time kernel
152s - max time network
162s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
18/07/2026, 10:01
General
- Target 2026-07-18_fb3f2dcb4f1bfbc092df7e13b0a982f1_akira_amadey_blankgrabber_brute-ratel_elex_emotet_glassw.exe
- Size 126.5MB
- Sample260718-l2k2msaz4v
- SHA256 0a9ffaecd88d8bfd912f8be8723949f3b4054a108f3723c70ac440eaa090d355
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 5 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: MapViewOfSection 3 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-18_fb3f2dcb4f1bfbc092df7e13b0a982f1_akira_amadey_blankgrabber_brute-ratel_elex_emotet_glassw.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-18_fb3f2dcb4f1bfbc092df7e13b0a982f1_akira_amadey_blankgrabber_brute-ratel_elex_emotet_glassw.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\AdminConsole\AdminConsole.exe"C:\ProgramData\AdminConsole\AdminConsole.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k AssignedAccessManagerSvc -s AssignedAccessManagerSvc1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
AdminConsole.exe
Cache.pmt
lnEj32.dll
System.dll
modern-wizard.bmp
nsDialogs.dll
memory/1572-140-0x0000000180000000-0x00000001803EA000-memory.dmp
memory/1572-139-0x0000000180000000-0x00000001803EA000-memory.dmp
memory/1572-137-0x0000000180000000-0x00000001803EA000-memory.dmp
memory/1572-136-0x0000000180000000-0x00000001803EA000-memory.dmp
memory/1572-129-0x000002111CF60000-0x000002111D346000-memory.dmp
memory/1572-138-0x0000000180000000-0x00000001803EA000-memory.dmp
memory/1572-141-0x0000000180000000-0x00000001803EA000-memory.dmp
memory/1572-201-0x0000000180000000-0x00000001803EA000-memory.dmp
memory/1572-127-0x0000000180000000-0x00000001803EA000-memory.dmp
memory/2160-87-0x0000000010000000-0x0000000011207000-memory.dmp
memory/2160-86-0x0000000010000000-0x0000000011207000-memory.dmp
memory/2160-74-0x0000000010000000-0x0000000011207000-memory.dmp
memory/2160-83-0x0000000010000000-0x0000000011207000-memory.dmp
memory/2160-85-0x0000000010000000-0x0000000011207000-memory.dmp
memory/2160-88-0x0000000010000000-0x0000000011207000-memory.dmp
memory/2160-89-0x000000000D470000-0x000000000E4B2000-memory.dmp
memory/4792-181-0x0000000180000000-0x00000001800BC000-memory.dmp
memory/4792-183-0x0000000180000000-0x00000001800BC000-memory.dmp
memory/4792-169-0x0000000180000000-0x00000001800BC000-memory.dmp
memory/4792-184-0x0000000180000000-0x00000001800BC000-memory.dmp
memory/4792-186-0x0000000180000000-0x00000001800BC000-memory.dmp
memory/4792-187-0x0000000180000000-0x00000001800BC000-memory.dmp
memory/4792-185-0x0000000180000000-0x00000001800BC000-memory.dmp
memory/4912-142-0x00000000010C0000-0x0000000001424000-memory.dmp
memory/4912-194-0x0000000003880000-0x00000000038A7000-memory.dmp
memory/4912-158-0x0000000010000000-0x000000001036B000-memory.dmp
memory/4912-161-0x0000000010000000-0x000000001036B000-memory.dmp
memory/4912-166-0x0000000010000000-0x000000001036B000-memory.dmp
memory/4912-143-0x0000000010000000-0x000000001036B000-memory.dmp
memory/4912-167-0x0000000010000000-0x000000001036B000-memory.dmp
memory/4912-160-0x0000000010000000-0x000000001036B000-memory.dmp
memory/4912-159-0x0000000010000000-0x000000001036B000-memory.dmp
memory/4912-157-0x0000000010000000-0x000000001036B000-memory.dmp
memory/4912-178-0x0000000010000000-0x000000001036B000-memory.dmp
memory/4912-156-0x0000000010000000-0x000000001036B000-memory.dmp
memory/4912-189-0x0000000003880000-0x00000000038A7000-memory.dmp
memory/4912-199-0x0000000003880000-0x00000000038A7000-memory.dmp
memory/4912-198-0x0000000003880000-0x00000000038A7000-memory.dmp
memory/4912-153-0x0000000010000000-0x000000001036B000-memory.dmp
memory/4912-195-0x0000000003880000-0x00000000038A7000-memory.dmp
memory/4912-196-0x0000000003880000-0x00000000038A7000-memory.dmp
memory/4912-188-0x0000000010000000-0x000000001036B000-memory.dmp
memory/4912-197-0x0000000003880000-0x00000000038A7000-memory.dmp
memory/4980-123-0x0000000180000000-0x0000000180A41000-memory.dmp
memory/4980-121-0x0000000180000000-0x0000000180A41000-memory.dmp
memory/4980-122-0x0000000180000000-0x0000000180A41000-memory.dmp
memory/4980-124-0x0000000180000000-0x0000000180A41000-memory.dmp
memory/4980-125-0x0000000180000000-0x0000000180A41000-memory.dmp
memory/4980-126-0x0000000180000000-0x0000000180A41000-memory.dmp
memory/4980-200-0x0000000000400000-0x0000000000A61000-memory.dmp
memory/4980-117-0x0000000180000000-0x0000000180A41000-memory.dmp
memory/4980-203-0x0000000000400000-0x0000000000A61000-memory.dmp
memory/4980-202-0x0000000180000000-0x0000000180A41000-memory.dmp