Overview
overview
9Static
static
3Aurora Wor...1N.exe
windows10-2004-x64
3Aurora Wor...1N.exe
windows11-21h2-x64
3FYI Worm v...ed.exe
windows10-2004-x64
3FYI Worm v...ed.exe
windows11-21h2-x64
3Uranium Worm.exe
windows10-2004-x64
3Uranium Worm.exe
windows11-21h2-x64
3Worm.exe
windows10-2004-x64
9Worm.exe
windows11-21h2-x64
9attworm/AT...ed.exe
windows10-2004-x64
3attworm/AT...ed.exe
windows11-21h2-x64
3attworm/cracker.exe
windows10-2004-x64
7attworm/cracker.exe
windows11-21h2-x64
7d4ta.exe
windows10-2004-x64
3d4ta.exe
windows11-21h2-x64
3Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
03/06/2026, 07:37
Static task
static1
Behavioral task
behavioral1
Sample
Aurora Worm v1-Cracked by RoN1N.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
Aurora Worm v1-Cracked by RoN1N.exe
Resource
win11-20260513-en
Behavioral task
behavioral3
Sample
FYI Worm v1.0 Cracked.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
FYI Worm v1.0 Cracked.exe
Resource
win11-20260513-en
Behavioral task
behavioral5
Sample
Uranium Worm.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
Uranium Worm.exe
Resource
win11-20260513-en
Behavioral task
behavioral7
Sample
Worm.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
Worm.exe
Resource
win11-20260513-en
Behavioral task
behavioral9
Sample
attworm/ATTWorm Cracked.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
attworm/ATTWorm Cracked.exe
Resource
win11-20260513-en
Behavioral task
behavioral11
Sample
attworm/cracker.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
attworm/cracker.exe
Resource
win11-20260513-en
Behavioral task
behavioral13
Sample
d4ta.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
d4ta.exe
Resource
win11-20260513-en
General
- Target d4ta.exe
- Size 21KB
- Sample260603-jgbw5ab18k
- SHA256 fa47cd33a4252fd92794182216f5295d45ee9ab29d9f2d26c192ceec5d66c36f
- MD5 eddb4cfd77fce7992305c228538d4259
- SHA1 49cd5b40c7dc2ee963bc4c05c197aaca267d5f1e
- SHA512 23b03c166db2313713286500e5b0ce5e09f4d1b9eb9fc680c0fa2271dac48e154719a24981f70dab68ee4637a6c6b3b5209fa01d4fd11b16147c48bc2777eaf4
- SSDEEP 384:trkZ4kg6bGY63fbvqU4ALf48XiQfstZY16pXVyXFY:tK4kXGYkfbvv4EN6jN
- TLSH T17BA24B1673E8C733CAFD1BB95862675402B1CE435117FB2F4C98356E2E773418E8269A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d4ta.exe