5f892b6444c7bb91e1ce1e546e9df7ee984b43caec40926aa0390dd88824a2e1

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Akira (OLD).exe
Size 5.4MB
Sample261014-2fc2xaay2p
SHA256 5f892b6444c7bb91e1ce1e546e9df7ee984b43caec40926aa0390dd88824a2e1
MD5 5e506f9a56f2cc676dedc9dc171e358d
SHA1 287dbb3d7fe83f2baff2701df9abaf2edecc1b93
SHA512 8ba936e3995248202569564ff059f232b59949c3a9e7e74fcbdfcc74499c637eb671b19e0d9596c864d8baa99b0524ebed6c3e59cd59af90a210d4c2c6e9c80f
SSDEEP 49152:9PBEenep7yTwv0wSoSThu8m+vmOC16a5VE9eIAEk1kWduoGnK09gafdlF:Xn0pShu8m+vmOWk9e1D1XFydlF
TLSH
T134468D6A7AC5805DD17BB27D888B6BC7C53630C24B1257CF1360076A2F7BAE41E79B60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
7	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
716	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Akira (OLD).exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Akira (OLD).exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4308 wrote to memory of 716	4308	Akira (OLD).exe	90

C:\Users\Admin\AppData\Local\Temp\Akira (OLD).exe
"C:\Users\Admin\AppData\Local\Temp\Akira (OLD).exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uninsep.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uninsep.bat

Path C:\Users\Admin\AppData\Local\Temp\_uninsep.bat
Size 235B
SHA256 ed2a018376989879c074768417c82054cb94d26ccf51e76d80bde38615d152b1
MD5 6ba3a2e2792705edd3c5189d8e4a4ec7
SHA1 7ed49a3e1f9e8f8def8765002eb65c52fc9cea7d
SHA512 b9989484510d5b5bd76426c33a10e3112e087bf2e6f7a413e1d1efbdf0e32816418a271a4184b463aaa026cde07e668403c278b255ad846ca95c2fa8e9459f28
TLSH
T162D0A71241D6EB5E1418803B4EB5638CC0F4CC5C3F863B109722CC4E2181C0DF5C7302
MD5 SHA1 SHA512 TLSH

Submit Download