Analysis
- max time kernel
149s - max time network
128s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/07/2026, 02:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-20_fc58549d99637278a27fbb2317534339_akira.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
21 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-20_fc58549d99637278a27fbb2317534339_akira.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
21 signatures
150 seconds
General
- Target 2026-07-20_fc58549d99637278a27fbb2317534339_akira.exe
- Size 10.3MB
- Sample260720-csveaae12v
- SHA256 88fe7c7547e2949cc70834f7425e2ca5c6187db6826c58aab23516b936cf6e2d
- MD5 fc58549d99637278a27fbb2317534339
- SHA1 690bc2428abbdd4c8569a4530df83f05a8a07d1d
- SHA512 9995009c86f27da8257b7a93545ad13a8b859674ef61d6b0caa6ac5c3b26ac56b2d83c353e2dbb5c7118d19c5979a95c4686042e8e29de785696e8dc9d7c2e77
- SSDEEP 24576:zVVjxPn9CAfyDA1ZsjTykBbKhmbCuvAjcbr5mvQAm+91U+o/LE495mbo0ojWc1RA:h1HECik/F7zPZDJ3OE5Ge
- TLSH T14EB6AFB875443CE2F66F477BD99AACDC03B61763AA8795C9406577C30DA33E5EE02808
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 4 IoCs
resource yara_rule behavioral1/memory/5016-0-0x0000022CD6840000-0x0000022CD6C9C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/5016-10-0x0000022CD6840000-0x0000022CD6C9C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/5016-11-0x0000022CD6840000-0x0000022CD6C9C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/5016-12-0x0000022CD6840000-0x0000022CD6C9C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs - Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 4 IoCs
resource yara_rule behavioral1/memory/5016-0-0x0000022CD6840000-0x0000022CD6C9C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/5016-10-0x0000022CD6840000-0x0000022CD6C9C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/5016-11-0x0000022CD6840000-0x0000022CD6C9C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/5016-12-0x0000022CD6840000-0x0000022CD6C9C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers - Detects executables containing SQL queries to confidential data stores. Observed in infostealers 4 IoCs
resource yara_rule behavioral1/memory/5016-0-0x0000022CD6840000-0x0000022CD6C9C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/5016-10-0x0000022CD6840000-0x0000022CD6C9C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/5016-11-0x0000022CD6840000-0x0000022CD6C9C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/5016-12-0x0000022CD6840000-0x0000022CD6C9C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore - Detects executables containing common artifacts observed in infostealers 4 IoCs
resource yara_rule behavioral1/memory/5016-0-0x0000022CD6840000-0x0000022CD6C9C000-memory.dmp INDICATOR_SUSPICIOUS_GENInfoStealer behavioral1/memory/5016-10-0x0000022CD6840000-0x0000022CD6C9C000-memory.dmp INDICATOR_SUSPICIOUS_GENInfoStealer behavioral1/memory/5016-11-0x0000022CD6840000-0x0000022CD6C9C000-memory.dmp INDICATOR_SUSPICIOUS_GENInfoStealer behavioral1/memory/5016-12-0x0000022CD6840000-0x0000022CD6C9C000-memory.dmp INDICATOR_SUSPICIOUS_GENInfoStealer - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 4 IoCs
resource yara_rule behavioral1/memory/5016-0-0x0000022CD6840000-0x0000022CD6C9C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender behavioral1/memory/5016-10-0x0000022CD6840000-0x0000022CD6C9C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender behavioral1/memory/5016-11-0x0000022CD6840000-0x0000022CD6C9C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender behavioral1/memory/5016-12-0x0000022CD6840000-0x0000022CD6C9C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Detects executables referencing combination of virtualization drivers 4 IoCs
resource yara_rule behavioral1/memory/5016-0-0x0000022CD6840000-0x0000022CD6C9C000-memory.dmp INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb behavioral1/memory/5016-10-0x0000022CD6840000-0x0000022CD6C9C000-memory.dmp INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb behavioral1/memory/5016-11-0x0000022CD6840000-0x0000022CD6C9C000-memory.dmp INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb behavioral1/memory/5016-12-0x0000022CD6840000-0x0000022CD6C9C000-memory.dmp INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb - Detects executables referencing many IR and analysis tools 4 IoCs
resource yara_rule behavioral1/memory/5016-0-0x0000022CD6840000-0x0000022CD6C9C000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools behavioral1/memory/5016-10-0x0000022CD6840000-0x0000022CD6C9C000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools behavioral1/memory/5016-11-0x0000022CD6840000-0x0000022CD6C9C000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools behavioral1/memory/5016-12-0x0000022CD6840000-0x0000022CD6C9C000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools - Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 4 IoCs
resource yara_rule behavioral1/memory/5016-0-0x0000022CD6840000-0x0000022CD6C9C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/5016-10-0x0000022CD6840000-0x0000022CD6C9C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/5016-11-0x0000022CD6840000-0x0000022CD6C9C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/5016-12-0x0000022CD6840000-0x0000022CD6C9C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store - Detects executables referencing specific set of files observed in sandob anti-evation, and Emotet 4 IoCs
resource yara_rule behavioral1/memory/5016-0-0x0000022CD6840000-0x0000022CD6C9C000-memory.dmp INDICATOR_SUSPICIOUS_Sandbox_Evasion_FilesComb behavioral1/memory/5016-10-0x0000022CD6840000-0x0000022CD6C9C000-memory.dmp INDICATOR_SUSPICIOUS_Sandbox_Evasion_FilesComb behavioral1/memory/5016-11-0x0000022CD6840000-0x0000022CD6C9C000-memory.dmp INDICATOR_SUSPICIOUS_Sandbox_Evasion_FilesComb behavioral1/memory/5016-12-0x0000022CD6840000-0x0000022CD6C9C000-memory.dmp INDICATOR_SUSPICIOUS_Sandbox_Evasion_FilesComb - Detects executables using Telegram Chat Bot 4 IoCs
resource yara_rule behavioral1/memory/5016-0-0x0000022CD6840000-0x0000022CD6C9C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TelegramChatBot behavioral1/memory/5016-10-0x0000022CD6840000-0x0000022CD6C9C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TelegramChatBot behavioral1/memory/5016-11-0x0000022CD6840000-0x0000022CD6C9C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TelegramChatBot behavioral1/memory/5016-12-0x0000022CD6840000-0x0000022CD6C9C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TelegramChatBot - Enumerates VirtualBox DLL files 2 TTPs 3 IoCs
description ioc Process File opened (read-only) C:\Windows\System32\vboxdisp.dll 2026-07-20_fc58549d99637278a27fbb2317534339_akira.exe File opened (read-only) C:\Windows\System32\vboxhook.dll 2026-07-20_fc58549d99637278a27fbb2317534339_akira.exe File opened (read-only) C:\Windows\System32\vboxogl.dll 2026-07-20_fc58549d99637278a27fbb2317534339_akira.exe - Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest 2026-07-20_fc58549d99637278a27fbb2317534339_akira.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse 2026-07-20_fc58549d99637278a27fbb2317534339_akira.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF 2026-07-20_fc58549d99637278a27fbb2317534339_akira.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService 2026-07-20_fc58549d99637278a27fbb2317534339_akira.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo 2026-07-20_fc58549d99637278a27fbb2317534339_akira.exe - Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions 2026-07-20_fc58549d99637278a27fbb2317534339_akira.exe - Looks for VirtualBox drivers on disk 2 TTPs 4 IoCs
description ioc Process File opened (read-only) C:\Windows\System32\drivers\VBoxGuest.sys 2026-07-20_fc58549d99637278a27fbb2317534339_akira.exe File opened (read-only) C:\Windows\System32\drivers\VBoxMouse.sys 2026-07-20_fc58549d99637278a27fbb2317534339_akira.exe File opened (read-only) C:\Windows\System32\drivers\VBoxSF.sys 2026-07-20_fc58549d99637278a27fbb2317534339_akira.exe File opened (read-only) C:\Windows\System32\drivers\VBoxVideo.sys 2026-07-20_fc58549d99637278a27fbb2317534339_akira.exe - Looks for VirtualBox executables on disk 2 TTPs 3 IoCs
description ioc Process File opened (read-only) C:\Windows\System32\VBoxControl.exe 2026-07-20_fc58549d99637278a27fbb2317534339_akira.exe File opened (read-only) C:\Windows\System32\VBoxService.exe 2026-07-20_fc58549d99637278a27fbb2317534339_akira.exe File opened (read-only) C:\Windows\System32\VBoxTray.exe 2026-07-20_fc58549d99637278a27fbb2317534339_akira.exe - Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools 2026-07-20_fc58549d99637278a27fbb2317534339_akira.exe - Looks for VMWare drivers on disk 2 TTPs 4 IoCs
description ioc Process File opened (read-only) C:\Windows\System32\drivers\vmmouse.sys 2026-07-20_fc58549d99637278a27fbb2317534339_akira.exe File opened (read-only) C:\Windows\System32\drivers\vmhgfs.sys 2026-07-20_fc58549d99637278a27fbb2317534339_akira.exe File opened (read-only) C:\Windows\System32\drivers\vmci.sys 2026-07-20_fc58549d99637278a27fbb2317534339_akira.exe File opened (read-only) C:\Windows\System32\drivers\vmmemctl.sys 2026-07-20_fc58549d99637278a27fbb2317534339_akira.exe - Looks for VMWare services registry key. 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse 2026-07-20_fc58549d99637278a27fbb2317534339_akira.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmx86 2026-07-20_fc58549d99637278a27fbb2317534339_akira.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci 2026-07-20_fc58549d99637278a27fbb2317534339_akira.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 api.ipify.org 4 api.ipify.org
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_fc58549d99637278a27fbb2317534339_akira.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-20_fc58549d99637278a27fbb2317534339_akira.exe"1⤵
- Enumerates VirtualBox DLL files
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VirtualBox drivers on disk
- Looks for VirtualBox executables on disk
- Looks for VMWare Tools registry key
- Looks for VMWare drivers on disk
- Looks for VMWare services registry key.
PID:5016
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1