adf29ae00ef640568ea02ecf5914825e01188dc8a1b9fa7a942f993350ad9415

General

Target
2026-07-22_e2b87b2fb609a38e3d1cbc4a5970cca1_akira.exe
Size 3.9MB
Sample260722-24sr9sstdx
SHA256 adf29ae00ef640568ea02ecf5914825e01188dc8a1b9fa7a942f993350ad9415
MD5 e2b87b2fb609a38e3d1cbc4a5970cca1
SHA1 bd772df0750d3d7c31a5cc6759694ab609869dad
SHA512 c3f65d9a9044f977a6ada84d0e5ba2c90eed7207d968acecc8b4f2209e492fd75762f5bc9247358734efc8bc3819052bdf5ce8da241c57a4794c18d6578584f3
SSDEEP 98304:uHY3ZFvPGD5rbOz+8vTD9HB1TX4v7KfeGVcTBQ/tC8wFjYkR+8:uu1PYGZvTD9h1DhSBQ/tCLjRs
TLSH
T1B216235736E554ACD515C038C3AAE5337733B88A0631FCFB22E486302E59FA96B1C75A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

credential_access defense_evasion execution spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4232	SystemSettings.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
1	api.gofile.io
5	discord.com
12	discord.com
13	api.gofile.io

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3352	cmd.exe
5180	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SystemSettings.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	SystemSettings.exe

Kills process with taskkill 4 IoCs

defense_evasion

pid	Process
692	taskkill.exe
3520	taskkill.exe
3320	taskkill.exe
3144	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4232	SystemSettings.exe
4232	SystemSettings.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	692	taskkill.exe
Token: SeDebugPrivilege	3520	taskkill.exe
Token: SeDebugPrivilege	3320	taskkill.exe
Token: SeDebugPrivilege	3144	taskkill.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 4232	2944	2026-07-22_e2b87b2fb609a38e3d1cbc4a5970cca1_akira.exe	89
PID 4232 wrote to memory of 3352	4232	SystemSettings.exe	90
PID 3352 wrote to memory of 5180	3352	cmd.exe	92
PID 5180 wrote to memory of 692	5180	cmd.exe	94
PID 5180 wrote to memory of 3520	5180	cmd.exe	96
PID 5180 wrote to memory of 3320	5180	cmd.exe	98
PID 5180 wrote to memory of 3144	5180	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-07-22_e2b87b2fb609a38e3d1cbc4a5970cca1_akira.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_e2b87b2fb609a38e3d1cbc4a5970cca1_akira.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemSettings.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemSettings.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4232
- - C:\Windows\system32\cmd.exe
    "cmd.exe" /c start /min "" C:\Users\Admin\AppData\Local\Temp\1e1a6710.bat
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3352
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\1e1a6710.bat
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5180
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "SystemSettings.exe"
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:692
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "SystemSettings.exe"
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3520
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "SystemSettings.exe"
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3320
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "SystemSettings.exe"
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

5

T1552

Credentials In Files

4

T1552.001

Credentials in Registry

1

T1552.002

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

4

T1005

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1e1a6710.bat

Path C:\Users\Admin\AppData\Local\Temp\1e1a6710.bat
Size 265B
SHA256 bc05fd00cc565b253268c51888642c4d7166e42a58c45925e5dd8119dbf364cf
MD5 2e88a512cd8d69dd33f03e7d4a5217de
SHA1 7dbe668df880372254396d8d0a6157d55ad78469
SHA512 0336edae33ab7f5a3b70ff47ce3f701833ffd83c0c9fdc8f331e68810d9ea53affaec45a261058d4237ab5b5a2b03b6598d105add5e060233ab9f03ddb0fa95c
TLSH
T12ED05B1A1144CD8FF42224D247FF4145E569C2931D00FBB591C110B8B491294E7BB6C9
MD5 SHA1 SHA512 TLSH

Submit Download

SystemSettings.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemSettings.exe
Size 3.6MB
SHA256 5a5dc7bb38e44686b0cd439b736ad79e293d1228843757f21a2197da64dc1376
MD5 dd2f32e65fb73e0e2d504331316e4227
SHA1 f23096b80f7dae17fc89c9d57a4c22c8d8b64c81
SHA512 1382aa5f3fd8a3e54cf886d12f4cd641804d54b4e3d32ad107deab4a195a8fb9c457e08c3ccfb21f25899f678981334f8a1ff5e8d67cf2e7896ea84ca92b5167
SSDEEP 49152:TAKPthhwnbvvJ2aWzHs6NpGCIymrFpjMRB7pIrEfvFxgoEgijXiSb3sM2Dn5L65M:P1weJVE/C6zqv
TLSH
T141066C03FB9581E9C06EC174875A9333AA76F88D4620B65F67D4CB213E26F609F4E358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2944-22-0x00007FF60BDE0000-0x00007FF60C1CE000-memory.dmp

Download

memory/4232-3-0x00007FFF47380000-0x00007FFF475E3000-memory.dmp

Download

memory/4232-23-0x00007FF7AFAE0000-0x00007FF7AFE79000-memory.dmp

Download

memory/4232-26-0x00007FF7AFAE0000-0x00007FF7AFE79000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads