a5898f2074c31c6d44fcc92eae000294bb55e77c816f0f9c55a25a51b8267c94

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/09/2026, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-01_0098e36249cfc533ebfa7c53c2a63903_akira_elex.exe
Size 5.5MB
Sample260901-2fnhmssxes
SHA256 a5898f2074c31c6d44fcc92eae000294bb55e77c816f0f9c55a25a51b8267c94
MD5 0098e36249cfc533ebfa7c53c2a63903
SHA1 23a5d7784eee4e77ec1319692f38e15c4e767fe1
SHA512 5e809373c9e085f632021bee088f1ee423a5f0226908f41fe25880f399dd999c8e3a5ebfcd8e410ec40a0b5499cffdef2cd459cc62d79fd38279341350be6822
SSDEEP 98304:XpDMNIG1WKNS3lgrC95c1fiTi5RvDWZdiJA0/quZ:XpDMxWb3arC95c1fGKRrWZF0/t
TLSH
T184467C52A5D37ABEE2C37130147A6227FEF9062847048FF6E342CD6C2576BB52D7418A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
6136	a.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-01_0098e36249cfc533ebfa7c53c2a63903_akira_elex.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-01_0098e36249cfc533ebfa7c53c2a63903_akira_elex.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-01_0098e36249cfc533ebfa7c53c2a63903_akira_elex.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4828

C:\ProgramData\DiagTrack\be64337e8ff86140\a.exe
C:\ProgramData\DiagTrack\be64337e8ff86140\a.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

a.exe

Path C:\ProgramData\DiagTrack\be64337e8ff86140\a.exe
Size 7.2MB
SHA256 6d0641d743fa467ab6c4d1a8c945c7cfb74238e7a77395ea26a49696c045c6fd
MD5 2eff9c1dba43d8c7058f7f539e32d0b7
SHA1 a56c807d34052c5f3f9e3a3f0b5b043bcba46821
SHA512 095f1c0bbe49524cac058f26fc90862148fea0b5858262602d426a2276fe47c8ac467be17cdaa06fdaefb655ad3f1b1f9e1a82c3b19493c339f4f07454c6cdda
SSDEEP 196608:XpDMxWb3arC95c1fGKRrWZF0//fxequHXqGem:GxWbKccHRKQ/U3Km
TLSH
T11776AE52A5D37ABDE2C3713014BA6227FEF9062847048FF6E342CD6C2576BB52D7418A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6136-1517-0x0000000000370000-0x0000000000374000-memory.dmp

Download