Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
06/10/2026, 16:03
General
- Target 2026-10-06_000548d2965b6640a8eb22ddb75026bb_akira_elex.exe
- Size 7.8MB
- Sample261006-thfxksfe42
- SHA256 dbf897a39682df23ffced74677e4a5abc6292752a6f9721e88724db004f7425d
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-06_000548d2965b6640a8eb22ddb75026bb_akira_elex.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-06_000548d2965b6640a8eb22ddb75026bb_akira_elex.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\7309a08073eae2da.doc"2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\7309a08073eae2da.doc" /o ""3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\mshta.exeC:\Windows\System32\mshta.exe "C:\ProgramData\Search\dfe8dcd01729db41\launch.hta"1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Search\dfe8dcd01729db41\ZillberReleyHost.exe"C:\ProgramData\Search\dfe8dcd01729db41\ZillberReleyHost.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Search\dfe8dcd01729db41\ZillberReleyHost.exeC:\ProgramData\Search\dfe8dcd01729db41\ZillberReleyHost.exe --monitor 24843⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
ZillberReleyHost.exe
launch.hta
B76BE66D46C355931939D8CF818D03FD_68DC46933CF3DE41CC968E0784D43DC3
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
B76BE66D46C355931939D8CF818D03FD_68DC46933CF3DE41CC968E0784D43DC3
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
7309a08073eae2da.doc
gb.xsl
cab30E.tmp
cab30F.tmp
cab320.tmp
cab321.tmp
cab322.tmp
cab323.tmp
cab324.tmp
cab325.tmp
cab326.tmp
cab327.tmp
cab338.tmp
cab3B1.tmp
cab3C3.tmp
1FIN37SAHVUIS7D6R6HU.temp
memory/2484-1658-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/2484-1712-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/2484-1653-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/2484-1656-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/2484-1524-0x0000000006B70000-0x0000000006BD6000-memory.dmp
memory/2484-1527-0x0000000007320000-0x00000000073B2000-memory.dmp
memory/2484-1528-0x0000000007980000-0x0000000007F3A000-memory.dmp
memory/2484-1660-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/2484-1662-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/2484-1664-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/2484-1515-0x00000000063E0000-0x000000000641E000-memory.dmp
memory/2484-1672-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/2484-1674-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/2484-1676-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/2484-1678-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/2484-1680-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/2484-1684-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/2484-1686-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/2484-1688-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/2484-1692-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/2484-1514-0x0000000003F10000-0x0000000003F30000-memory.dmp
memory/2484-1694-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/2484-1696-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/2484-1698-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/2484-1702-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/2484-1704-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/2484-1652-0x0000000007F40000-0x000000000815A000-memory.dmp
memory/2484-1654-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/2484-1513-0x0000000003E80000-0x0000000003EF8000-memory.dmp
memory/2484-1666-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/2484-1670-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/2484-1669-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/2484-1682-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/2484-1690-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/2484-1700-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/2484-1710-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/2484-1722-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/2484-1730-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/2484-1744-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/2484-1756-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/2484-1754-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/2484-1752-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/2484-1750-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/2484-1748-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/2484-1746-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/2484-1742-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/2484-1740-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/2484-1738-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/2484-1736-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/2484-1734-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/2484-1732-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/2484-1728-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/2484-1726-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/2484-1724-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/2484-1720-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/2484-1718-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/2484-1716-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/2484-1714-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/2484-1706-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/2484-1708-0x0000000007F40000-0x0000000008154000-memory.dmp
memory/5052-476-0x00007FFAC119F000-0x00007FFAC11A0000-memory.dmp
memory/5052-1651-0x00007FFAC1040000-0x00007FFAC12A3000-memory.dmp
memory/5052-1648-0x00007FFA81180000-0x00007FFA81190000-memory.dmp
memory/5052-1649-0x00007FFA81180000-0x00007FFA81190000-memory.dmp
memory/5052-1650-0x00007FFA81180000-0x00007FFA81190000-memory.dmp
memory/5052-1647-0x00007FFA81180000-0x00007FFA81190000-memory.dmp
memory/5052-461-0x00007FFA81180000-0x00007FFA81190000-memory.dmp
memory/5052-456-0x00007FFA81180000-0x00007FFA81190000-memory.dmp
memory/5052-453-0x00007FFA81180000-0x00007FFA81190000-memory.dmp
memory/5052-455-0x00007FFA81180000-0x00007FFA81190000-memory.dmp
memory/5052-572-0x00007FFAC1040000-0x00007FFAC12A3000-memory.dmp
memory/5052-525-0x00007FFA81180000-0x00007FFA81190000-memory.dmp
memory/5052-1516-0x00007FFAC1040000-0x00007FFAC12A3000-memory.dmp
memory/5052-571-0x00007FFAC1040000-0x00007FFAC12A3000-memory.dmp
memory/5052-580-0x00007FFA7EDD0000-0x00007FFA7EDE0000-memory.dmp
memory/5052-528-0x00007FFAC1040000-0x00007FFAC12A3000-memory.dmp
memory/5052-527-0x00007FFAC1040000-0x00007FFAC12A3000-memory.dmp
memory/5052-526-0x00007FFAC1040000-0x00007FFAC12A3000-memory.dmp
memory/5052-477-0x00007FFAC1040000-0x00007FFAC12A3000-memory.dmp
memory/5052-617-0x00007FFA7EDD0000-0x00007FFA7EDE0000-memory.dmp