Analysis
- max time kernel
150s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/08/2026, 21:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-23_dea7cec05e094b494c5c27980ac41c4c_akira.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-23_dea7cec05e094b494c5c27980ac41c4c_akira.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-23_dea7cec05e094b494c5c27980ac41c4c_akira.exe
- Size 5.4MB
- Sample260825-1evpwszamd
- SHA256 e32e59955131a7207956dc794818ba320b6c3d6249be867e87ca66d8ac834cfe
- MD5 dea7cec05e094b494c5c27980ac41c4c
- SHA1 99345ca45388631584802ca5ea4b56024f5a43df
- SHA512 37280d448614329b0ff13ff2b950a0c0ef5a664cb83af62bd56c18e42043f8eab236ddb2f7bf29f9fe40e0ac2b4531d3ac865e264356bb47b7f1a0b4aeaaaa5f
- SSDEEP 98304:7HUnjjkrsCoEqtdNabYsL8m8HWggsH1iZhWRGN9KRHzobBkHY:bMjSkdYUslq/gsgv8GN9KVkbeHY
- TLSH T104461201B5A06DADEE47E178829E9336B679B8850733EFBB0176D7301D42A936F1C709
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5820 2026-08-23_dea7cec05e094b494c5c27980ac41c4c_akira.exe 5820 2026-08-23_dea7cec05e094b494c5c27980ac41c4c_akira.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1808 ShellHost.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5820 wrote to memory of 3472 5820 2026-08-23_dea7cec05e094b494c5c27980ac41c4c_akira.exe 50 PID 5820 wrote to memory of 3472 5820 2026-08-23_dea7cec05e094b494c5c27980ac41c4c_akira.exe 50
Processes
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_dea7cec05e094b494c5c27980ac41c4c_akira.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-23_dea7cec05e094b494c5c27980ac41c4c_akira.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5820
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:1808