cd14a535f45a2d8a3087fa1bd39c1a841ee195d6fee79e728b87d1c7c614da06

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 09:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_b3fc274c7b8e888332ecf2a9d5a00e40_akira.exe
Size 386KB
Sample260808-lscnxadj21
SHA256 cd14a535f45a2d8a3087fa1bd39c1a841ee195d6fee79e728b87d1c7c614da06
MD5 b3fc274c7b8e888332ecf2a9d5a00e40
SHA1 769b7f67013442ed3caa7ba3fe6a578cbf6eabc7
SHA512 bc26b2e306c48b87165c5c9699437144c76de28ba2889a2da36202404a41d0da19a5c6bbb54379c91a46fd45f80c4f4f5791177756751d1da4e761ee7f4a4082
SSDEEP 6144:JmTmXgXzziQAYnDxlAvAjsDAVRQhvRJW5+nJDh3yNNsHXNzzY7zkH:wTIgXP6vAYDgQvRJW0nJDwk9JH
TLSH
T1CB847D43B69591FCD156C038939B9573B633B88A0631BDBF13E896302F66E512F2CB19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

credential_access discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
behavioral1/memory/3636-0-0x00007FF773180000-0x00007FF7731E6000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4128	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3632	netsh.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\ProcessorNameString	reg.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
1584	wmic.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
4452	reg.exe
2264	reg.exe
2688	reg.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1584	wmic.exe
Token: SeSecurityPrivilege	1584	wmic.exe
Token: SeTakeOwnershipPrivilege	1584	wmic.exe
Token: SeLoadDriverPrivilege	1584	wmic.exe
Token: SeSystemProfilePrivilege	1584	wmic.exe
Token: SeSystemtimePrivilege	1584	wmic.exe
Token: SeProfSingleProcessPrivilege	1584	wmic.exe
Token: SeIncBasePriorityPrivilege	1584	wmic.exe
Token: SeCreatePagefilePrivilege	1584	wmic.exe
Token: SeBackupPrivilege	1584	wmic.exe
Token: SeRestorePrivilege	1584	wmic.exe
Token: SeShutdownPrivilege	1584	wmic.exe
Token: SeDebugPrivilege	1584	wmic.exe
Token: SeSystemEnvironmentPrivilege	1584	wmic.exe
Token: SeRemoteShutdownPrivilege	1584	wmic.exe
Token: SeUndockPrivilege	1584	wmic.exe
Token: SeManageVolumePrivilege	1584	wmic.exe
Token: 33	1584	wmic.exe
Token: 34	1584	wmic.exe
Token: 35	1584	wmic.exe
Token: 36	1584	wmic.exe
Token: SeIncreaseQuotaPrivilege	1584	wmic.exe
Token: SeSecurityPrivilege	1584	wmic.exe
Token: SeTakeOwnershipPrivilege	1584	wmic.exe
Token: SeLoadDriverPrivilege	1584	wmic.exe
Token: SeSystemProfilePrivilege	1584	wmic.exe
Token: SeSystemtimePrivilege	1584	wmic.exe
Token: SeProfSingleProcessPrivilege	1584	wmic.exe
Token: SeIncBasePriorityPrivilege	1584	wmic.exe
Token: SeCreatePagefilePrivilege	1584	wmic.exe
Token: SeBackupPrivilege	1584	wmic.exe
Token: SeRestorePrivilege	1584	wmic.exe
Token: SeShutdownPrivilege	1584	wmic.exe
Token: SeDebugPrivilege	1584	wmic.exe
Token: SeSystemEnvironmentPrivilege	1584	wmic.exe
Token: SeRemoteShutdownPrivilege	1584	wmic.exe
Token: SeUndockPrivilege	1584	wmic.exe
Token: SeManageVolumePrivilege	1584	wmic.exe
Token: 33	1584	wmic.exe
Token: 34	1584	wmic.exe
Token: 35	1584	wmic.exe
Token: 36	1584	wmic.exe
Token: SeDebugPrivilege	4128	tasklist.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3636 wrote to memory of 1276	3636	2026-08-08_b3fc274c7b8e888332ecf2a9d5a00e40_akira.exe	86
PID 3636 wrote to memory of 4120	3636	2026-08-08_b3fc274c7b8e888332ecf2a9d5a00e40_akira.exe	87
PID 3636 wrote to memory of 3884	3636	2026-08-08_b3fc274c7b8e888332ecf2a9d5a00e40_akira.exe	88
PID 3636 wrote to memory of 2688	3636	2026-08-08_b3fc274c7b8e888332ecf2a9d5a00e40_akira.exe	89
PID 3636 wrote to memory of 4452	3636	2026-08-08_b3fc274c7b8e888332ecf2a9d5a00e40_akira.exe	90
PID 3636 wrote to memory of 1584	3636	2026-08-08_b3fc274c7b8e888332ecf2a9d5a00e40_akira.exe	91
PID 3636 wrote to memory of 2264	3636	2026-08-08_b3fc274c7b8e888332ecf2a9d5a00e40_akira.exe	93
PID 3636 wrote to memory of 3632	3636	2026-08-08_b3fc274c7b8e888332ecf2a9d5a00e40_akira.exe	94
PID 3636 wrote to memory of 4128	3636	2026-08-08_b3fc274c7b8e888332ecf2a9d5a00e40_akira.exe	95
PID 3636 wrote to memory of 924	3636	2026-08-08_b3fc274c7b8e888332ecf2a9d5a00e40_akira.exe	96
PID 924 wrote to memory of 2392	924	query.exe	97
PID 3636 wrote to memory of 4104	3636	2026-08-08_b3fc274c7b8e888332ecf2a9d5a00e40_akira.exe	98
PID 4104 wrote to memory of 3980	4104	net.exe	99
PID 3636 wrote to memory of 4536	3636	2026-08-08_b3fc274c7b8e888332ecf2a9d5a00e40_akira.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-08-08_b3fc274c7b8e888332ecf2a9d5a00e40_akira.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_b3fc274c7b8e888332ecf2a9d5a00e40_akira.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3636
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName
  2⤵
  PID:1276
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v DisplayVersion
  2⤵
  PID:4120
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuild
  2⤵
  PID:3884
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:2688
- C:\Windows\system32\reg.exe
  "reg" query HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor /v ProcessorNameString
  2⤵
  - Checks processor information in registry
  - Modifies registry key
  PID:4452
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path win32_VideoController get name
  2⤵
  - Detects videocard installed
  - Suspicious use of AdjustPrivilegeToken
  PID:1584
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SOFTWARE\WOW6432Node\Valve\Steam /v InstallPath
  2⤵
  - Modifies registry key
  PID:2264
- C:\Windows\system32\netsh.exe
  "netsh" wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:3632
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4128
- C:\Windows\system32\query.exe
  "query" user
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:924
- - C:\Windows\system32\quser.exe
    "C:\Windows\system32\quser.exe"
    3⤵
    PID:2392
- C:\Windows\system32\net.exe
  "net" user
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4104
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user
    3⤵
    PID:3980
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList"
  2⤵
  PID:4536