ad6576a18fc86102907c05e561839ab2b674796e9a534df117e0899c4afd0cd3

General

Target
2026-10-06_1319cb9adcb8f16f35e77c8836d7c2e0_akira_elex.exe
Size 19.3MB
Sample261006-std2paas2v
SHA256 ad6576a18fc86102907c05e561839ab2b674796e9a534df117e0899c4afd0cd3
MD5 1319cb9adcb8f16f35e77c8836d7c2e0
SHA1 389d8d26c3fd0eddde629c5a7ff70d6ed8770e3d
SHA512 12d3b7e191f2bbffb868bef96bbfb8ca10679fc44515a394df6c2581489736982e0fda8aa9968794625514b7e74867f6a490f483d465bfb9ef4eb45b8b070ae7
SSDEEP 393216:YQua2kdr7u5fDXeD411BIUoUMJ6wEGqy5oX1XHmR7WU9YcJTmgc:YQVzrad3PG3JSxy6XGPB6gc
TLSH
T136171292F5EB91B9FA0270769DF9B22FF4361E5403078DFBA3993A4C92356D8447A013
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery

Malware Config

Signatures

Detect binaries embedding considerable number of MFA browser extension IDs. 1 IoCs

resource	yara_rule
behavioral1/memory/3800-1305-0x0000000002FD0000-0x0000000002FE8000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
behavioral1/memory/3800-1305-0x0000000002FD0000-0x0000000002FE8000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral1/memory/3800-1305-0x0000000002FD0000-0x0000000002FE8000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing bas64 encoded gzip files 1 IoCs

resource	yara_rule
behavioral1/memory/3800-1305-0x0000000002FD0000-0x0000000002FE8000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	mshta.exe

Executes dropped EXE 1 IoCs

pid	Process
3800	iq.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	iq.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	iq.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-06_1319cb9adcb8f16f35e77c8836d7c2e0_akira_elex.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iq.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3528 wrote to memory of 3800	3528	mshta.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-10-06_1319cb9adcb8f16f35e77c8836d7c2e0_akira_elex.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-06_1319cb9adcb8f16f35e77c8836d7c2e0_akira_elex.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2500

C:\Windows\System32\mshta.exe
C:\Windows\System32\mshta.exe "C:\ProgramData\SystemData\30d4fdf211293635\launch.hta"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3528
- C:\ProgramData\SystemData\30d4fdf211293635\iq.exe
  "C:\ProgramData\SystemData\30d4fdf211293635\iq.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

iq.exe

Path C:\ProgramData\SystemData\30d4fdf211293635\iq.exe
Size 100.0MB
SHA256 1978ae5446a9e9aa7ddaaf6c6aeb28da58074f821ae5b6c2793e5c9d16e6d4f5
MD5 6c5d3f792e2d9ca4547f21461dd5f9e2
SHA1 7a80b276d7fd59e42a52f47d620ee44ce10f637f
SHA512 9821874d705d143953375983b666dca72217776a95d0cea287c01e484c19527ddeed60df49d4c8388f6b06cd09745316bfd4063cf1ca627cd0cb4e688e358f1c
SSDEEP 3145728:5d6UPba1v/+M2IpcIMV6SER38eNPuv5+3:/6Uba13MIuIMV6SRePuR+3
TLSH
T131383392F5EBD1B9FA0270765DF9B22EF4361E1403078EFBA39A7A0C92356D95479003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

launch.hta

Path C:\ProgramData\SystemData\30d4fdf211293635\launch.hta
Size 328B
SHA256 6669aa20ddd13d502ee339101f129f8bd06c41aa8a7932c1606a88e59e2de098
MD5 01216cbbd386650b5e769b73ddf54538
SHA1 45ac7e0f642263f31e568996f432e5d775514a78
SHA512 679ac3cd41c3a55744a28841d46f53552516b086050357828b4e9ba0d8da77c71a79c6d533c085a9f5747312432f66ff7935a019edc643a3d49c9bb53a9d8b7a
TLSH
T113E07DD45C42F2ECECCB2BE924EAF5581AC1546032CEDD26D5120069F702B501BA5A46
MD5 SHA1 SHA512 TLSH

Submit Download

Tmp99F9.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp99F9.tmp
Size 2KB
SHA256 01641aef8eb10b2fcf661b30df03622b7480cb919fd17a90402551de41db2a6b
MD5 71a39e1b20024bcc6c6d7bb66a8b1126
SHA1 9bc62f889687bddb0d19d5ed1430d7355fe6005e
SHA512 bdc28fa00169ed5bbe543689ef644fcf5a1e5fd976dcce104c09cc2848407d6c8e240c1fc4d39b87ccc749743227847be34ab04c880b712fa33e466a70f06cb9
TLSH
T1C841D77E706EB063BD0CBCBE6EAF0A416DB0C7965A3171CE23220A5D50552A2B6D9603
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3800-1304-0x0000000003020000-0x0000000003074000-memory.dmp

Download

memory/3800-1305-0x0000000002FD0000-0x0000000002FE8000-memory.dmp

Download

memory/3800-1306-0x0000000006190000-0x00000000061DC000-memory.dmp

Download

memory/3800-1319-0x0000000006470000-0x00000000064D6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads