Analysis
- max time kernel
149s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/10/2026, 21:53
General
- Target 2026-10-02_fabeee30119aa251be628359f51fcded_akira_elex.exe
- Size 2.0MB
- Sample261002-1r52dstepc
- SHA256 e76c859a552836c15f184ed3829767779e659ab58c408947105f523ebe3c89c9
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-02_fabeee30119aa251be628359f51fcded_akira_elex.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-02_fabeee30119aa251be628359f51fcded_akira_elex.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -Enc UgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AVABhAHMAawBOAGEAbQBlACAAJwB0AHcAaQBzAHQAZQBkAC4AZQB4AGUAJwAgAC0AQQBjAHQAaQBvAG4AIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAGMAdABpAG8AbgAgAC0ARQB4AGUAYwB1AHQAZQAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXAB0AHcAaQBzAHQAZQBkAC4AZQB4AGUAJwApACAALQBUAHIAaQBnAGcAZQByACAAKABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAVAByAGkAZwBnAGUAcgAgAC0ATwBuAGMAZQAgAC0AQQB0ACAAKABHAGUAdAAtAEQAYQB0AGUAKQAgAC0AUgBlAHAAZQB0AGkAdABpAG8AbgBJAG4AdABlAHIAdgBhAGwAIAAoAE4AZQB3AC0AVABpAG0AZQBTAHAAYQBuACAALQBNAGkAbgB1AHQAZQBzACAANQApACkAIAAtAFUAcwBlAHIAIAAkAGUAbgB2ADoAVQBzAGUAcgBOAGEAbQBlACAALQBSAHUAbgBMAGUAdgBlAGwAIABIAGkAZwBoAGUAcwB0ACAALQBTAGUAdAB0AGkAbgBnAHMAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBTAGUAdAB0AGkAbgBnAHMAUwBlAHQAIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0AUwBlAGMAbwBuAGQAcwAgADAAKQAgAC0AQQBsAGwAbwB3AFMAdABhAHIAdABJAGYATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAG8AbgB0AFMAdABvAHAASQBmAEcAbwBpAG4AZwBPAG4AQgBhAHQAdABlAHIAaQBlAHMAKQAgAC0ARgBvAHIAYwBlAA==2⤵
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_ehvfo2uf.h41.psm1
memory/4448-12-0x0000000006480000-0x00000000064A0000-memory.dmp
memory/4448-8-0x0000000073BF0000-0x00000000743AC000-memory.dmp
memory/4448-9-0x0000000073BF0000-0x00000000743AC000-memory.dmp
memory/4448-10-0x0000000073BF0000-0x00000000743AC000-memory.dmp
memory/4448-11-0x0000000073BF0000-0x00000000743AC000-memory.dmp
memory/4448-6-0x0000000073C02000-0x0000000073C03000-memory.dmp
memory/4448-13-0x00000000064B0000-0x00000000064F0000-memory.dmp
memory/4448-42-0x0000000073BF0000-0x00000000743AC000-memory.dmp
memory/4448-40-0x0000000073BF0000-0x00000000743AC000-memory.dmp
memory/4448-35-0x0000000073BF0000-0x00000000743AC000-memory.dmp
memory/4448-34-0x0000000073C02000-0x0000000073C03000-memory.dmp
memory/4448-7-0x00000000062A0000-0x000000000631A000-memory.dmp
memory/5800-26-0x0000000006E70000-0x0000000006EA6000-memory.dmp
memory/5800-15-0x0000000073BF0000-0x00000000743AC000-memory.dmp
memory/5800-23-0x0000000005B50000-0x0000000005EAB000-memory.dmp
memory/5800-24-0x0000000005EB0000-0x0000000005ECE000-memory.dmp
memory/5800-25-0x0000000005EF0000-0x0000000005F3C000-memory.dmp
memory/5800-20-0x0000000005950000-0x00000000059B6000-memory.dmp
memory/5800-27-0x0000000070590000-0x00000000705DC000-memory.dmp
memory/5800-28-0x0000000073BF0000-0x00000000743AC000-memory.dmp
memory/5800-18-0x0000000073BF0000-0x00000000743AC000-memory.dmp
memory/5800-31-0x00000000064A0000-0x00000000064C0000-memory.dmp
memory/5800-32-0x0000000007150000-0x00000000071F3000-memory.dmp
memory/5800-33-0x0000000073BF0000-0x00000000743AC000-memory.dmp
memory/5800-17-0x00000000050E0000-0x0000000005102000-memory.dmp
memory/5800-19-0x00000000058E0000-0x0000000005946000-memory.dmp
memory/5800-36-0x0000000007880000-0x0000000007EFC000-memory.dmp
memory/5800-37-0x0000000007220000-0x000000000723A000-memory.dmp
memory/5800-38-0x0000000007280000-0x000000000728A000-memory.dmp
memory/5800-39-0x0000000007480000-0x0000000007516000-memory.dmp
memory/5800-16-0x0000000005220000-0x000000000586A000-memory.dmp
memory/5800-41-0x0000000007400000-0x0000000007411000-memory.dmp
memory/5800-14-0x0000000002660000-0x0000000002696000-memory.dmp
memory/5800-43-0x0000000073BF0000-0x00000000743AC000-memory.dmp
memory/5800-44-0x0000000073BF0000-0x00000000743AC000-memory.dmp
memory/5800-45-0x0000000073BF0000-0x00000000743AC000-memory.dmp
memory/5800-47-0x0000000073BF0000-0x00000000743AC000-memory.dmp