Analysis
- max time kernel
150s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
06/10/2026, 15:59
General
- Target 2026-10-06_009fb18175e2474c7e5bcde076c104b9_akira_elex.exe
- Size 9.4MB
- Sample261006-te53asav8x
- SHA256 b15a2b504efb19d9ef5dff68b3598b2b28348aa883e51ac404ed022dd6322890
Malware Config
Signatures
- Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 17 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-06_009fb18175e2474c7e5bcde076c104b9_akira_elex.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-06_009fb18175e2474c7e5bcde076c104b9_akira_elex.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\c0a02243df5c1406.doc"2⤵
- Checks computer location settings
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\c0a02243df5c1406.doc" /o ""3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\mshta.exeC:\Windows\System32\mshta.exe "C:\ProgramData\Search\dfe8dcd01729db41\launch.hta"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Search\dfe8dcd01729db41\ZillberReleyHost.exe"C:\ProgramData\Search\dfe8dcd01729db41\ZillberReleyHost.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Search\dfe8dcd01729db41\ZillberReleyHost.exeC:\ProgramData\Search\dfe8dcd01729db41\ZillberReleyHost.exe --monitor 48843⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
ZillberReleyHost.exe
launch.hta
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
iso690.xsl
c0a02243df5c1406.doc
cab13BD.tmp
cab13BE.tmp
cab13BF.tmp
cab13C0.tmp
cab13D0.tmp
cab13D1.tmp
cab13D2.tmp
cab13D3.tmp
cab13D4.tmp
cab13D5.tmp
cab13D6.tmp
cab13F0.tmp
cab1433.tmp
cab14B2.tmp
8FRRWETWDO8GPKOD3X9Z.temp
memory/3264-610-0x00007FF821EF0000-0x00007FF8220E5000-memory.dmp
memory/3264-572-0x00007FF7E1F70000-0x00007FF7E1F80000-memory.dmp
memory/3264-1637-0x00007FF821EF0000-0x00007FF8220E5000-memory.dmp
memory/3264-1634-0x00007FF7E1F70000-0x00007FF7E1F80000-memory.dmp
memory/3264-1635-0x00007FF7E1F70000-0x00007FF7E1F80000-memory.dmp
memory/3264-1636-0x00007FF7E1F70000-0x00007FF7E1F80000-memory.dmp
memory/3264-633-0x00007FF821EF0000-0x00007FF8220E5000-memory.dmp
memory/3264-828-0x00007FF7DF840000-0x00007FF7DF850000-memory.dmp
memory/3264-723-0x00007FF7DF840000-0x00007FF7DF850000-memory.dmp
memory/3264-568-0x00007FF7E1F70000-0x00007FF7E1F80000-memory.dmp
memory/3264-569-0x00007FF7E1F70000-0x00007FF7E1F80000-memory.dmp
memory/3264-571-0x00007FF821F8D000-0x00007FF821F8E000-memory.dmp
memory/3264-581-0x00007FF821EF0000-0x00007FF8220E5000-memory.dmp
memory/3264-600-0x00007FF7E1F70000-0x00007FF7E1F80000-memory.dmp
memory/3264-618-0x00007FF821EF0000-0x00007FF8220E5000-memory.dmp
memory/3264-611-0x00007FF821EF0000-0x00007FF8220E5000-memory.dmp
memory/3264-1485-0x00007FF821EF0000-0x00007FF8220E5000-memory.dmp
memory/3264-1633-0x00007FF7E1F70000-0x00007FF7E1F80000-memory.dmp
memory/3264-570-0x00007FF7E1F70000-0x00007FF7E1F80000-memory.dmp
memory/4884-1484-0x0000000005C40000-0x0000000005C7E000-memory.dmp
memory/4884-1483-0x0000000005C20000-0x0000000005C40000-memory.dmp
memory/4884-1482-0x0000000001220000-0x0000000001298000-memory.dmp
memory/4884-1500-0x00000000071F0000-0x0000000007794000-memory.dmp
memory/4884-1499-0x0000000006BA0000-0x0000000006C32000-memory.dmp
memory/4884-1496-0x0000000006400000-0x0000000006466000-memory.dmp