Analysis
- max time kernel
150s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20251231-en - resource tags
- submitted
22/01/2026, 14:59
General
- Target aa5381241d4098aedad56fbb16582b38dd3ac372368519d7ec9f52612a211f3b.exe
- Size 1.4MB
- Sample260122-scte2set4e
- SHA256 23761caf7f4c6d7b3b4608c59729eb807c961deaa23aac94db5289b9b9739864
Malware Config
Signatures
- AmaqFinder
AmaqFinder is a loader written in Delphi, attributed to Prince of Persia, an Iranian threat group.
- Amaqfinder family
- Detects AmaqFinder payload 15 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa5381241d4098aedad56fbb16582b38dd3ac372368519d7ec9f52612a211f3b.exe"C:\Users\Admin\AppData\Local\Temp\aa5381241d4098aedad56fbb16582b38dd3ac372368519d7ec9f52612a211f3b.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4944-0-0x0000000000527000-0x0000000000529000-memory.dmp
memory/4944-1-0x0000000000400000-0x000000000057F000-memory.dmp
memory/4944-10-0x0000000000400000-0x000000000057F000-memory.dmp
memory/4944-11-0x0000000000400000-0x000000000057F000-memory.dmp
memory/4944-15-0x0000000000400000-0x000000000057F000-memory.dmp
memory/4944-18-0x0000000000400000-0x000000000057F000-memory.dmp
memory/4944-19-0x0000000000400000-0x000000000057F000-memory.dmp
memory/4944-22-0x0000000000400000-0x000000000057F000-memory.dmp
memory/4944-23-0x0000000000400000-0x000000000057F000-memory.dmp
memory/4944-26-0x0000000000400000-0x000000000057F000-memory.dmp
memory/4944-27-0x0000000000400000-0x000000000057F000-memory.dmp
memory/4944-30-0x0000000000400000-0x000000000057F000-memory.dmp
memory/4944-34-0x0000000000400000-0x000000000057F000-memory.dmp
memory/4944-35-0x0000000000400000-0x000000000057F000-memory.dmp
memory/4944-38-0x0000000000400000-0x000000000057F000-memory.dmp
memory/4944-41-0x0000000000400000-0x000000000057F000-memory.dmp