6e3afb3fbbe6c0377cb4733edd2b4135ef71b4aa17a734e8204af13cde5b792e

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 09:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_6775a388f161cd6edc5ef7c19afc0661_akira_coinminer_elex_emotet_glassworm_helldown_pos_qilin.exe
Size 59.2MB
Sample260824-ly2vzseq3x
SHA256 6e3afb3fbbe6c0377cb4733edd2b4135ef71b4aa17a734e8204af13cde5b792e
MD5 6775a388f161cd6edc5ef7c19afc0661
SHA1 1dc54a842be24cbe0b0d120dc1dffece74ffc632
SHA512 c44b9d32ecb1f3afb2f4d9448345f866d9bb21048e90276f05323c6f1c2a449cb7a410e23e806ee8b36e704c86768cbc0b5761e5c1aa837902cca88b1821f73b
SSDEEP 786432:iRMz6RugkD6PDmiZV24ovWx17cH52q25dE4:iRMz60gkD6bZrq25dE4
TLSH
T122D7AE54F9631AFBFE2BF0B0A0DEA3359A22992496119D73F40EF4663F3A3901D5814D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
behavioral2/memory/3180-0-0x0000000000B70000-0x00000000046AA000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects command variations typically used by ransomware 1 IoCs

resource	yara_rule
behavioral2/memory/3180-0-0x0000000000B70000-0x00000000046AA000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_6775a388f161cd6edc5ef7c19afc0661_akira_coinminer_elex_emotet_glassworm_helldown_pos_qilin.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-23_6775a388f161cd6edc5ef7c19afc0661_akira_coinminer_elex_emotet_glassworm_helldown_pos_qilin.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_6775a388f161cd6edc5ef7c19afc0661_akira_coinminer_elex_emotet_glassworm_helldown_pos_qilin.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3180-0-0x0000000000B70000-0x00000000046AA000-memory.dmp

Download